From nobody Fri Apr 3 04:40:03 2026 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E761234889A for ; Thu, 19 Feb 2026 15:43:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771515827; cv=none; b=C2DL4Z7RLQJ3OK3ZaygcNXAuIxGm4DfWALlf/bmadKYF9oG0w86bTkPaZDxnhsSad1Uv4SRVmTdjNiFmi13dU6jiL0ycdr1IKl7zlpunhcFxyPr/BCi/Qt35gHmVt+MbzczDcq3Fb+fJ0Uogf9VdkqppKlSroo+x8GQhJJjjcTQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771515827; c=relaxed/simple; bh=nzPlGBZWCF9yeYjLabCnMDGzP0Cy9kD50BaatJTqHwM=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=H4GzEbcLSntwaL/2fiS9olFCf6SFDxjK4PC7lNV+QcHVtpjxCGYksFFg/gcimA/VsY1H7dkwoeqOJMTj/CCfou3Mixr4fmdjRNfoKukKoNoQpuFx6JZTFDSUAJxOpPui4ZxZd8ZXdSGUpyZ1ZfqgoCrc6P0HNSfCIkMz7g7+tEk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--gnoack.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=f5Z7ktjq; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--gnoack.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="f5Z7ktjq" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-4836e35292cso10726075e9.1 for ; Thu, 19 Feb 2026 07:43:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1771515824; x=1772120624; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=gQkcQ412VYYjl5d+2hc4YyIXE6A0slRRsKwOiMGJ4lA=; b=f5Z7ktjqnbXA5BdkuRlF3mTxc5Cqp/HRktFqeCP17tyvgev7LlTTTyfNGJl0xqV9vE uZonCM97VmC+ut5wLbLKTp1kGeUOExY8Q1Ro8YWFKhXxsL9lrEiSBAs+cEU3d7zj9pRB ws7YME/KVK+UeoKro1aeuULP5BZb5ey6vqq0mmJqYsthS1oocdSv3OvngeICTpbDqmIv NsUgK1iTCpLW5vqY33OVcDaidBy+4LwHIb2B/uQlJpRUA9AI92DXYJNvkF8gy06+pS1t eRxyMDJgRvNe5JbcV8FSaFQu/nGUxpfT6dOO8TtEein1HidACU0ONqk11th2kOrI5jux mlsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771515824; x=1772120624; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=gQkcQ412VYYjl5d+2hc4YyIXE6A0slRRsKwOiMGJ4lA=; b=VdqRW9ntrpk6I0yBRVm3+MeGz3+H3s9UzxrkXDtVwfhuEYP+sq6s7yA2gPdBbm1wak cL+AUUD5R3TCU6/fPuxSASBXGgl8V20Z2p9tjm1B4SPdVM9Bj3l2H/j4Aj8j7XfuBocG mA9uW14e6yoaGVEzi8EeOnhR3AXej6AxKPWzF1oWN85dtu01wT8Gy5cfJydqp94GM/Mm pCXw4O6/aMzyVuHbmbibZkzFxxR185ut709oby4DMuL5S9FaWV+GV5BeavCzNtwp30lH UnhdGj5QfbuYzQH3UlwZUqHqaQbLaYfPaa9ZtrMo5I36/DUXX0EEgbgArLFaGduMd95S ONOQ== X-Forwarded-Encrypted: i=1; AJvYcCUtw74x1W9tlV4gK6AB4AuJTEUrtQn2MVZGx365tQkLF+jUyOfxP6Uz+iCjWRiEzoLxOtwTooqmDfAY5Ks=@vger.kernel.org X-Gm-Message-State: AOJu0YyhPTMEe4q2jsycNd5maEqJDnAUkgnpK9Zr0iBFa54nDo0elSAd jGzIMusYBILLLo5cyNYRWYTfzWCtMa1MRViG2vbzYiW/xDNPIIJ/vsY2gAnGrn3O9dUIl48l989 2S86uNw== X-Received: from wmjq15.prod.google.com ([2002:a7b:ce8f:0:b0:480:4a03:7b63]) (user=gnoack job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:4f44:b0:480:4b59:932e with SMTP id 5b1f17b1804b1-48373a0a0c2mr344104445e9.11.1771515824251; Thu, 19 Feb 2026 07:43:44 -0800 (PST) Date: Thu, 19 Feb 2026 16:43:35 +0100 In-Reply-To: <20260219154338.786625-1-gnoack@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260219154338.786625-1-gnoack@google.com> X-Mailer: git-send-email 2.53.0.371.g1d285c8824-goog Message-ID: <20260219154338.786625-2-gnoack@google.com> Subject: [PATCH v2 1/4] HID: Document memory allocation properties of report_fixup() From: "=?UTF-8?q?G=C3=BCnther=20Noack?=" To: Jiri Kosina , Benjamin Tissoires Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, "=?UTF-8?q?G=C3=BCnther=20Noack?=" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The memory pointer returned by the report_fixup() hook does not get freed by the caller. Instead, report_fixup() must return (in return value and *rsize) a memory buffer with at least the same lifetime as the input buffer (defined by rdesc and original *rsize). This is usually achieved using one of the following techniques: * Returning a pointer and size to a sub-portion of the input buffer * Returning a pointer to a static buffer * Allocating a buffer with a devm_*() function, which will automatically get freed when the device is removed. Signed-off-by: G=C3=BCnther Noack --- include/linux/hid.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/linux/hid.h b/include/linux/hid.h index dce862cafbbd..2990b9f94cb5 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -836,6 +836,12 @@ struct hid_usage_id { * raw_event and event should return negative on error, any other value wi= ll * pass the event on to .event() typically return 0 for success. * + * report_fixup must return a report descriptor pointer whose lifetime is = at + * least that of the input rdesc. This is usually done by mutating the in= put + * rdesc and returning it or a sub-portion of it. In case a new buffer is + * allocated and returned, the implementation of report_fixup is responsib= le for + * freeing it later. + * * input_mapping shall return a negative value to completely ignore this u= sage * (e.g. doubled or invalid usage), zero to continue with parsing of this * usage by generic code (no special handling needed) or positive to skip --=20 2.53.0.371.g1d285c8824-goog From nobody Fri Apr 3 04:40:03 2026 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8BC33346FC3 for ; Thu, 19 Feb 2026 15:43:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771515829; cv=none; b=Mldv83BrW5O1er9nISfVvrcuBgtBcvMUYMe4eoIvjt4foflumx/f7Ie/1z+nLqId1jG9UzawpWkZ2viiEVVoedjCbg/i5PnimpzJouhAczk9IXzlAZ35JN4KA5is7YvL94GNSuFTziEIA/WmlThfdnhaU5gTNBgrsPANYOQ0BuI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771515829; c=relaxed/simple; bh=yNwLklFgEsd/71GG4AgwLwAO0rS2VcvNhtibRM3aU8o=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=FyrDPkkjUXFCipwy7nVWLmyKo9v3ykyXTmGRCypK4q28kYBAas0QV9XlZlBx9YLh3uEeyJpPk70tdW0AM5vLF7HjsvZNPlNdlwyWbBCA46KWHnmMJ3yGX7Gnmz0xwRZFPsgzKFldg6apFQq9k1u510ks7kfuE92b/7E5Pet6rd8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--gnoack.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=G+fVbb7G; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--gnoack.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="G+fVbb7G" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-4837bfcfe0dso11477375e9.1 for ; Thu, 19 Feb 2026 07:43:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1771515827; x=1772120627; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=Ww1BEiMaHLfYZUa/3tnTdN6593kM77ve8/k6LvZ/MCY=; b=G+fVbb7GnOAJqZPP2PLafR5DqEBMMRAGku+Od65HqsGTQoq0Hl0z2fnD7WfK+YKKoq tzGLbQllqXGucc/Z+GL+NMm1SVhcdhqfWZob5JvLPAuOAm08/DaW+Mts+CsU/7vo+w+c nd+KmAB/cXwqDA9yuubgbvFzcp6xaLRCD4g7lyBdqPbuQFWfR0qGN05HPcJYRwE+XMJC sbg4mBvxGaorHnh2008Wvf4zcb2fi6ri4Jri6H+8S9DJdrMdBdYtca9sNA2InnZC98pj hMLIyyuoPrzwL1tjjOCZo6FNkGbLPYC9dCMhfgvTl8O4UtoeW8wnKoesqQQVPCjIEwcW rdtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771515827; x=1772120627; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=Ww1BEiMaHLfYZUa/3tnTdN6593kM77ve8/k6LvZ/MCY=; b=pRIucAjWfRgMG3ym+MiqCUPHPQfC5xVTf6zK7qkc+Ab9/jmRyI+j0uz6x7ZwT8ui+x 4bXIwn55XPRWyntfYWV5VffHK20VJjRgUQ1okDjRWH2Fw4XO+EYuAq4uqujUkz6uID7l XdpF9LFJFt71xdpjYj9DGE6x9NgR3fy4l1nCpsCYq7zhgMbIQJyCDnxCAT0Jp+M/r6/x zOnCN6Y8CPJxaWetkdTcyEz7UZ962qbkLK7KUBOmhUiR/bKf9xTkag4X9SrCCLKUuy4r nlFu//g8ZStrnQ5+mDklouTXsAwEqIL4QE7q2qiOatakBgvYcmQs10PCxtEWXzycXcCR mbfQ== X-Forwarded-Encrypted: i=1; AJvYcCXxrSepQXroZyza3Es5O5HbZvkbv+FNBr9F9ClkMnfzsS4D8k+ks3xzdyeSmNMIUliFVV8y7kSCJdKQ6tA=@vger.kernel.org X-Gm-Message-State: AOJu0YzhLxUERzMA0uplsT0RVA1ayFNdduA4YeDUoHcvPw3KrOM9Lk7x KhXCynqO8vCA1aoqewNtfG8n3x5pccnk80W+0HeVdhhzwC3OvDQJxHp9rWPTvqY+EBmG72VP3Ad or/fjcA== X-Received: from wmos16.prod.google.com ([2002:a05:600c:45d0:b0:477:a181:1922]) (user=gnoack job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:698c:b0:477:5ad9:6df1 with SMTP id 5b1f17b1804b1-48379b932b7mr332791135e9.3.1771515826700; Thu, 19 Feb 2026 07:43:46 -0800 (PST) Date: Thu, 19 Feb 2026 16:43:36 +0100 In-Reply-To: <20260219154338.786625-1-gnoack@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260219154338.786625-1-gnoack@google.com> X-Mailer: git-send-email 2.53.0.371.g1d285c8824-goog Message-ID: <20260219154338.786625-3-gnoack@google.com> Subject: [PATCH v2 2/4] HID: apple: avoid memory leak in apple_report_fixup() From: "=?UTF-8?q?G=C3=BCnther=20Noack?=" To: Jiri Kosina , Benjamin Tissoires Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, "=?UTF-8?q?G=C3=BCnther=20Noack?=" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller. Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: G=C3=BCnther Noack --- drivers/hid/hid-apple.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c index 233e367cce1d..894adc23367b 100644 --- a/drivers/hid/hid-apple.c +++ b/drivers/hid/hid-apple.c @@ -686,9 +686,7 @@ static const __u8 *apple_report_fixup(struct hid_device= *hdev, __u8 *rdesc, hid_info(hdev, "fixing up Magic Keyboard battery report descriptor\n"); *rsize =3D *rsize - 1; - rdesc =3D kmemdup(rdesc + 1, *rsize, GFP_KERNEL); - if (!rdesc) - return NULL; + rdesc =3D rdesc + 1; =20 rdesc[0] =3D 0x05; rdesc[1] =3D 0x01; --=20 2.53.0.371.g1d285c8824-goog From nobody Fri Apr 3 04:40:03 2026 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E65834A3AC for ; Thu, 19 Feb 2026 15:43:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771515832; cv=none; b=Nbsgh6fALw5JLQjNAllUGXCBnDYTVGzzD2ttWHV5ODCqj0VPjjafwM/anaOWcikhYz1sO6C+x3PYAFlsMiKjgTbw7or5P0oVJ4s2URA+j0CUhT0WXEDAk7844cLz9CRP9O+0ZV6w4S5J6Q2SDtwbHDp+GmwtMcrd5RTL+aIQPGc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771515832; c=relaxed/simple; bh=L3lZgJogZtRo+hrmpb9U1UPAKGerds0qMe0Up81PuIU=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=htP0AOGFZg14zH9Gys2qSaOD/tsqzAzgGo4GtteQyCWzmrV4nhaDWUpncRk8vfNqs6tvnXhTbaidrYomg/+FHlWk2A4wBgOFdsbQZ6yF7bQKaqhFs7z7znzVuHXf6w/W0jWrqom3Xb8XZeKa4ljopIom9s9lul1T8vWlAW9XLr8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--gnoack.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=bkXnnY3R; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--gnoack.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="bkXnnY3R" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-4806cfffca6so11106905e9.2 for ; Thu, 19 Feb 2026 07:43:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1771515829; x=1772120629; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=Hyc0hh7Bv1PMxa3L5KyyOW4WOvgP8JpSIAxvqyUwZoc=; b=bkXnnY3R7wa2h+9ve/KZpE5j5fcrl22Oe/rO3ymln+dFTi1ZfjQNdlrmV+Hzcmkqu9 AHZppFB8QvwHWeCcNUa0V/z8pv5rnADPSb4Y8G7+HhSeIAOncEVb/vlCLqd/49RaRK+2 lbm/Pnag9/6ZHN2iWgDcVOF93SXeKyaycB56CNMlFFD87pE0CTO8DV/qL0URwLtenrWA ide7TIej6Swb7jql7KmW0GjQ0J+TNyLVZkcAfM6Pqf40pcugptU8aONyZFRXt8o4/vfh xIqIAUglNRfU+6KSmwnXKQYauG+ezyt5JuQ71y/JoWHA3NZjUURGn/ExIHVky+LfRSrU MvZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771515829; x=1772120629; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=Hyc0hh7Bv1PMxa3L5KyyOW4WOvgP8JpSIAxvqyUwZoc=; b=EeF/tYwJmgYvAAi14+PnWelNuUHDpPq4LkqLCTx/f3ZddMTYVmTU3X3dMRrcxa0BZn 5q7lIx4Y4/wMyPQ+56fmtExttwuVr/afxAtJ5jakSCgxBPYckqIG8wLGmLDC0KgOwDDT fnZhPmhN8YS7g5LkFEcZpclt38oa2nlQxJPCzvfng5DhAfeoCMWrJg4/fd0aijm8H5O9 H5UsvCf+498x4ANmAs1yQVEPGX+HzFNkVRqFrPhrDx3diP2MgrL3zDPH/BBl17FuDFGV RCM9ylVhPyRYc6IEWyqaezVMgpugc1K2ZVOccQpwYB9rrL3X5VjIbd0R6HOGSR6EBwHI VDbw== X-Forwarded-Encrypted: i=1; AJvYcCW5DffV5aiBisc7s8+kbvh6fa7IOcFE9vlDAYiomoH/DQwUynxPZ/EzC4XWIfVCdwHvLCMgkVbgrMT69ZI=@vger.kernel.org X-Gm-Message-State: AOJu0YzBo557hi69mYZhb+Nfre4EMwKrxKYwBcadtCCr/P74pgEM7gEP nYPU/9ObP6Nx7UMPI+IH/6ciJA+x3Po4CAePhOQIndCwasJ6vDhPxWHDdzQSYPDTKIypeAJSVTC wZIQnbg== X-Received: from wmjs18.prod.google.com ([2002:a7b:c392:0:b0:482:dff5:2424]) (user=gnoack job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:314f:b0:483:6fe1:c057 with SMTP id 5b1f17b1804b1-48373a3f3bcmr344540285e9.21.1771515829387; Thu, 19 Feb 2026 07:43:49 -0800 (PST) Date: Thu, 19 Feb 2026 16:43:37 +0100 In-Reply-To: <20260219154338.786625-1-gnoack@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260219154338.786625-1-gnoack@google.com> X-Mailer: git-send-email 2.53.0.371.g1d285c8824-goog Message-ID: <20260219154338.786625-4-gnoack@google.com> Subject: [PATCH v2 3/4] HID: magicmouse: avoid memory leak in magicmouse_report_fixup() From: "=?UTF-8?q?G=C3=BCnther=20Noack?=" To: Jiri Kosina , Benjamin Tissoires Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, "=?UTF-8?q?G=C3=BCnther=20Noack?=" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller. Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: G=C3=BCnther Noack --- drivers/hid/hid-magicmouse.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c index 91f621ceb924..17908d52c027 100644 --- a/drivers/hid/hid-magicmouse.c +++ b/drivers/hid/hid-magicmouse.c @@ -994,9 +994,7 @@ static const __u8 *magicmouse_report_fixup(struct hid_d= evice *hdev, __u8 *rdesc, hid_info(hdev, "fixing up magicmouse battery report descriptor\n"); *rsize =3D *rsize - 1; - rdesc =3D kmemdup(rdesc + 1, *rsize, GFP_KERNEL); - if (!rdesc) - return NULL; + rdesc =3D rdesc + 1; =20 rdesc[0] =3D 0x05; rdesc[1] =3D 0x01; --=20 2.53.0.371.g1d285c8824-goog From nobody Fri Apr 3 04:40:03 2026 Received: from mail-ed1-f73.google.com (mail-ed1-f73.google.com [209.85.208.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6D43349B18 for ; Thu, 19 Feb 2026 15:43:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771515835; cv=none; b=VOpXnRRDg1p3vbJ412jfRy7gab1SkxXG6tkmvxifwFsH5zWMdh0H9KANBy2uOWCzNJ7+urriep+RpkvahS7DM5M2+SRkbiVfP+l/aD6SmAFyi0IWx1fnHAaPFfLm58I9k/6OGM4iq0zz2/wRnAh09T5UdZs+BgAOOxMMeSsK08s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771515835; c=relaxed/simple; bh=cUSJCknygC+/rZNVU9qIxxltk2KbFVYUK1d/VUQYy98=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=ZeclsR85M3Y4lgkK7RQ8Knr8pGesknn3jmy0mTmXIZFNht9wrpanxSSLAds7T8dIE81lUncSrdheWm/4Sc3fypw9w/cZ0mQVKuaqkTU4YVbRjEWcCLsqy4sJX8DHMOfbLPmTlfqyyeJaCc3mcrN+ZVwo8b/R9Mxx3ws9sgNC8ps= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--gnoack.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=CUNp4dlk; arc=none smtp.client-ip=209.85.208.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--gnoack.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="CUNp4dlk" Received: by mail-ed1-f73.google.com with SMTP id 4fb4d7f45d1cf-65b9da5fffcso1062773a12.3 for ; Thu, 19 Feb 2026 07:43:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1771515832; x=1772120632; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=TgkhJcDrOmi7WULhBZy1laqS/BExdWrs8De6OLys9NE=; b=CUNp4dlkkgaAH/M0utpGMCPaqj2DV8N1XFEpkIICPz7G9VHrzryIm7FM0lNMgHN02E aym5+vKUXTffVAaMRrLB/uCoCWFSCWOlL/Fo88ucIsYyoHK+Erw1gN1TThDQfgeBZJD9 Y/W4Y9CUep7rjtqZICemZezJb6VUFfOBs02DI9g4H/WKY+3C9kkpk4piC6Zd+u1xSnuh geXoodLDxvl3hT4tfC5VXgH+JpOMz1DF8XnBILeUr7KmVHWDcmxQxG6FRJ3z0VtmVB/0 UMo0f1vnjKwc7YKPe8XCmNOPKV2SiBy2qxCyUBOfGwKkX+5QtB1xNyuaHcf076GmaRU9 NrUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771515832; x=1772120632; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=TgkhJcDrOmi7WULhBZy1laqS/BExdWrs8De6OLys9NE=; b=aZoTO0lmNiDIFO0NLO4ea4XeWfgsYlpDXHu6At+9Tl+RJBxzPCORCG9yzqhR7A1eA5 J0t5ZNG/I+3/O1uXAIhdm/kvBNn73532xpvIqXrdFeOqZqHBK4ZLmMGDV2GvHzBTK0UM OAeWDiBscsOyTSoZJR6fSuH32EB7fNxgLk1BxTy6o6EP+lfbT8BkxSfhtS2ObHmAI2Au 3qRGCZ3dqRxCa37LlD3t7xTXy4zXWVLiNFSRSCZK3PEyY94YvMeDUjxu0d5Gap3xiut6 Npn4c8bcFgpJzr6GfrWrD9T9KspuwY2UUP8sYvolqBdktNeUr2++1CflhZjp/kxgGSWT M3mA== X-Forwarded-Encrypted: i=1; AJvYcCXBLds49hR8X5S4YiqycIViP42NwM2QFuSJ9VwgCDqNvm2gAq4vAQ+PbgHMpFC46QuT66ckObTkiWtByeU=@vger.kernel.org X-Gm-Message-State: AOJu0Yy+HJqqFP81uL8nYvXMEVbN2VrFftQ2uhlVqAzospuXC3tXUwhg eneEoMvzNEZ1B38jeXvMnp8I1ACx9vM+0JvsK6GoN8o+j7e7FjityGMybC78vmGSIWShlDcR4u4 oa4K4fg== X-Received: from edok19.prod.google.com ([2002:aa7:c053:0:b0:65b:958b:ff4a]) (user=gnoack job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6402:34ce:b0:658:b837:7953 with SMTP id 4fb4d7f45d1cf-65bc78653cemr10329654a12.12.1771515831853; Thu, 19 Feb 2026 07:43:51 -0800 (PST) Date: Thu, 19 Feb 2026 16:43:38 +0100 In-Reply-To: <20260219154338.786625-1-gnoack@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260219154338.786625-1-gnoack@google.com> X-Mailer: git-send-email 2.53.0.371.g1d285c8824-goog Message-ID: <20260219154338.786625-5-gnoack@google.com> Subject: [PATCH v2 4/4] HID: asus: avoid memory leak in asus_report_fixup() From: "=?UTF-8?q?G=C3=BCnther=20Noack?=" To: Jiri Kosina , Benjamin Tissoires Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, "=?UTF-8?q?G=C3=BCnther=20Noack?=" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer. Also fix a harmless out-of-bounds read by copying only the original descriptor size. Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: G=C3=BCnther Noack --- drivers/hid/hid-asus.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 8ffcd12038e8..7a08e964b9cc 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -1399,14 +1399,21 @@ static const __u8 *asus_report_fixup(struct hid_dev= ice *hdev, __u8 *rdesc, */ if (*rsize =3D=3D rsize_orig && rdesc[offs] =3D=3D 0x09 && rdesc[offs + 1] =3D=3D 0x76) { - *rsize =3D rsize_orig + 1; - rdesc =3D kmemdup(rdesc, *rsize, GFP_KERNEL); - if (!rdesc) - return NULL; + __u8 *new_rdesc; + + new_rdesc =3D devm_kzalloc(&hdev->dev, rsize_orig + 1, + GFP_KERNEL); + if (!new_rdesc) + return rdesc; =20 hid_info(hdev, "Fixing up %s keyb report descriptor\n", drvdata->quirks & QUIRK_T100CHI ? "T100CHI" : "T90CHI"); + + memcpy(new_rdesc, rdesc, rsize_orig); + *rsize =3D rsize_orig + 1; + rdesc =3D new_rdesc; + memmove(rdesc + offs + 4, rdesc + offs + 2, 12); rdesc[offs] =3D 0x19; rdesc[offs + 1] =3D 0x00; --=20 2.53.0.371.g1d285c8824-goog