.../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +- .../intel-quickspi/quickspi-protocol.c | 15 ++++++++++++--- .../intel-quickspi/quickspi-protocol.h | 2 +- 3 files changed, 14 insertions(+), 5 deletions(-)
quickspi_hid_raw_request() receives the caller's buffer length in len, but
quickspi_get_report() never sees it and copies the whole device-supplied
response into buf regardless:
memcpy(buf, qsdev->report_buf, qsdev->report_len);
qsdev->report_len comes from the input report the touch controller returns,
while buf is sized to whatever the caller asked hidraw for through
HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf
with device-controlled content.
The intel-quicki2c sibling already passes the caller length down to
quicki2c_get_report() and validates the response against it before the
copy. Do the same here.
Fixes: 4138f21115ae ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI driver")
Suggested-by: Sashiko AI <sashiko-bot@kernel.org>
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
---
v2: fixed a Time-of-Check-to-Time-of-Use race the Sashiko AI review of v1
pointed out - the new bound read qsdev->report_len once for the check
and again for the memcpy, so a concurrent update between the two could
have overflowed buf with the checked-against-a-smaller-value length.
Read it once into a local and use that for both. No other change.
v1: https://lore.kernel.org/all/20260806133838.3378362-1-sammiee5311@gmail.com/
.../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +-
.../intel-quickspi/quickspi-protocol.c | 15 ++++++++++++---
.../intel-quickspi/quickspi-protocol.h | 2 +-
3 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
index 91d5807b4a83..a60a0a7f16aa 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
@@ -61,7 +61,7 @@ static int quickspi_hid_raw_request(struct hid_device *hid,
switch (reqtype) {
case HID_REQ_GET_REPORT:
- ret = quickspi_get_report(qsdev, rtype, reportnum, buf);
+ ret = quickspi_get_report(qsdev, rtype, reportnum, buf, len);
break;
case HID_REQ_SET_REPORT:
ret = quickspi_set_report(qsdev, rtype, reportnum, buf, len);
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
index cb19057f1191..10b06dea3961 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
@@ -342,10 +342,12 @@ int reset_tic(struct quickspi_device *qsdev)
}
int quickspi_get_report(struct quickspi_device *qsdev,
- u8 report_type, unsigned int report_id, void *buf)
+ u8 report_type, unsigned int report_id, void *buf,
+ u32 buf_len)
{
int rep_type;
int ret;
+ u32 report_len;
if (report_type == HID_INPUT_REPORT) {
rep_type = GET_INPUT_REPORT;
@@ -372,9 +374,16 @@ int quickspi_get_report(struct quickspi_device *qsdev,
}
qsdev->get_report_cmpl = false;
- memcpy(buf, qsdev->report_buf, qsdev->report_len);
+ report_len = qsdev->report_len;
+ if (report_len > buf_len) {
+ dev_err_once(qsdev->dev, "Get report response too big, %u vs %u\n",
+ report_len, buf_len);
+ return -EINVAL;
+ }
+
+ memcpy(buf, qsdev->report_buf, report_len);
- return qsdev->report_len;
+ return report_len;
}
int quickspi_set_report(struct quickspi_device *qsdev,
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
index 775e29c1ed13..8a2338bee808 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
@@ -12,7 +12,7 @@ struct quickspi_device;
void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len);
int quickspi_get_report(struct quickspi_device *qsdev, u8 report_type,
- unsigned int report_id, void *buf);
+ unsigned int report_id, void *buf, u32 buf_len);
int quickspi_set_report(struct quickspi_device *qsdev, u8 report_type,
unsigned int report_id, void *buf, u32 buf_len);
int quickspi_get_report_descriptor(struct quickspi_device *qsdev);
--
2.43.0quickspi_hid_raw_request() receives the caller's buffer length in len, but
quickspi_get_report() never sees it and copies the whole device-supplied
response into buf regardless:
memcpy(buf, qsdev->report_buf, qsdev->report_len);
qsdev->report_len comes from the input report the touch controller returns,
while buf is sized to whatever the caller asked hidraw for through
HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf
with device-controlled content.
The intel-quicki2c sibling already passes the caller length down to
quicki2c_get_report() and validates the response against it before the
copy. Do the same here.
Fixes: 4138f21115ae ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI driver")
Suggested-by: Sashiko AI <sashiko-bot@kernel.org>
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
---
v3: added READ_ONCE() around the qsdev->report_len read the v2 bound uses -
quickspi_handle_input_data() writes this field from IRQ context with no
locking, so per kernel convention for a lockless shared read it needs
READ_ONCE() regardless of how many times the value is used afterward.
Raised by the Sashiko AI review of v2. No other change.
v2: fixed a Time-of-Check-to-Time-of-Use race the Sashiko AI review of v1
pointed out - the new bound read qsdev->report_len once for the check
and again for the memcpy, so a concurrent update between the two could
have overflowed buf with the checked-against-a-smaller-value length.
Read it once into a local and use that for both.
v1: https://lore.kernel.org/all/20260806133838.3378362-1-sammiee5311@gmail.com/
.../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +-
.../intel-quickspi/quickspi-protocol.c | 16 +++++++++++++---
.../intel-quickspi/quickspi-protocol.h | 2 +-
3 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
index 91d5807b4a83..a60a0a7f16aa 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
@@ -61,7 +61,7 @@ static int quickspi_hid_raw_request(struct hid_device *hid,
switch (reqtype) {
case HID_REQ_GET_REPORT:
- ret = quickspi_get_report(qsdev, rtype, reportnum, buf);
+ ret = quickspi_get_report(qsdev, rtype, reportnum, buf, len);
break;
case HID_REQ_SET_REPORT:
ret = quickspi_set_report(qsdev, rtype, reportnum, buf, len);
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
index cb19057f1191..9dacfdf7aff6 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
@@ -342,10 +342,12 @@ int reset_tic(struct quickspi_device *qsdev)
}
int quickspi_get_report(struct quickspi_device *qsdev,
- u8 report_type, unsigned int report_id, void *buf)
+ u8 report_type, unsigned int report_id, void *buf,
+ u32 buf_len)
{
int rep_type;
int ret;
+ u32 report_len;
if (report_type == HID_INPUT_REPORT) {
rep_type = GET_INPUT_REPORT;
@@ -372,9 +374,17 @@ int quickspi_get_report(struct quickspi_device *qsdev,
}
qsdev->get_report_cmpl = false;
- memcpy(buf, qsdev->report_buf, qsdev->report_len);
+ /* quickspi_handle_input_data() updates this from IRQ context. */
+ report_len = READ_ONCE(qsdev->report_len);
+ if (report_len > buf_len) {
+ dev_err_once(qsdev->dev, "Get report response too big, %u vs %u\n",
+ report_len, buf_len);
+ return -EINVAL;
+ }
+
+ memcpy(buf, qsdev->report_buf, report_len);
- return qsdev->report_len;
+ return report_len;
}
int quickspi_set_report(struct quickspi_device *qsdev,
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
index 775e29c1ed13..8a2338bee808 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
@@ -12,7 +12,7 @@ struct quickspi_device;
void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len);
int quickspi_get_report(struct quickspi_device *qsdev, u8 report_type,
- unsigned int report_id, void *buf);
+ unsigned int report_id, void *buf, u32 buf_len);
int quickspi_set_report(struct quickspi_device *qsdev, u8 report_type,
unsigned int report_id, void *buf, u32 buf_len);
int quickspi_get_report_descriptor(struct quickspi_device *qsdev);
--
2.43.0On Thu, 6 Aug 2026, HyeongJun An wrote:
> quickspi_hid_raw_request() receives the caller's buffer length in len, but
> quickspi_get_report() never sees it and copies the whole device-supplied
> response into buf regardless:
>
> memcpy(buf, qsdev->report_buf, qsdev->report_len);
>
> qsdev->report_len comes from the input report the touch controller returns,
> while buf is sized to whatever the caller asked hidraw for through
> HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf
> with device-controlled content.
>
> The intel-quicki2c sibling already passes the caller length down to
> quicki2c_get_report() and validates the response against it before the
> copy. Do the same here.
>
> Fixes: 4138f21115ae ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI driver")
> Suggested-by: Sashiko AI <sashiko-bot@kernel.org>
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Applied, thanks.
--
Jiri Kosina
SUSE Labs
> -----Original Message-----
> From: HyeongJun An <sammiee5311@gmail.com>
> Sent: Thursday, August 6, 2026 10:56 PM
> To: Jiri Kosina <jikos@kernel.org>; Xu, Even <even.xu@intel.com>; Sun, Xinpeng
> <xinpeng.sun@intel.com>
> Cc: Benjamin Tissoires <bentiss@kernel.org>; linux-input@vger.kernel.org; linux-
> kernel@vger.kernel.org; stable@vger.kernel.org; HyeongJun An
> <sammiee5311@gmail.com>; Sashiko AI <sashiko-bot@kernel.org>
> Subject: [PATCH v3] HID: intel-thc-hid: intel-quickspi: bound GET_REPORT
> response to the caller buffer
>
> quickspi_hid_raw_request() receives the caller's buffer length in len, but
> quickspi_get_report() never sees it and copies the whole device-supplied
> response into buf regardless:
>
> memcpy(buf, qsdev->report_buf, qsdev->report_len);
>
> qsdev->report_len comes from the input report the touch controller
> qsdev->returns,
> while buf is sized to whatever the caller asked hidraw for through
> HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf
> with device-controlled content.
>
> The intel-quicki2c sibling already passes the caller length down to
> quicki2c_get_report() and validates the response against it before the copy. Do
> the same here.
>
> Fixes: 4138f21115ae ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI
> driver")
> Suggested-by: Sashiko AI <sashiko-bot@kernel.org>
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
> ---
> v3: added READ_ONCE() around the qsdev->report_len read the v2 bound uses -
> quickspi_handle_input_data() writes this field from IRQ context with no
> locking, so per kernel convention for a lockless shared read it needs
> READ_ONCE() regardless of how many times the value is used afterward.
> Raised by the Sashiko AI review of v2. No other change.
>
> v2: fixed a Time-of-Check-to-Time-of-Use race the Sashiko AI review of v1
> pointed out - the new bound read qsdev->report_len once for the check
> and again for the memcpy, so a concurrent update between the two could
> have overflowed buf with the checked-against-a-smaller-value length.
> Read it once into a local and use that for both.
>
> v1: https://lore.kernel.org/all/20260806133838.3378362-1-
> sammiee5311@gmail.com/
>
> .../intel-thc-hid/intel-quickspi/quickspi-hid.c | 2 +-
> .../intel-quickspi/quickspi-protocol.c | 16 +++++++++++++---
> .../intel-quickspi/quickspi-protocol.h | 2 +-
> 3 files changed, 15 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
> b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
> index 91d5807b4a83..a60a0a7f16aa 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c
> @@ -61,7 +61,7 @@ static int quickspi_hid_raw_request(struct hid_device *hid,
>
> switch (reqtype) {
> case HID_REQ_GET_REPORT:
> - ret = quickspi_get_report(qsdev, rtype, reportnum, buf);
> + ret = quickspi_get_report(qsdev, rtype, reportnum, buf, len);
> break;
> case HID_REQ_SET_REPORT:
> ret = quickspi_set_report(qsdev, rtype, reportnum, buf, len); diff -
> -git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> index cb19057f1191..9dacfdf7aff6 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
> @@ -342,10 +342,12 @@ int reset_tic(struct quickspi_device *qsdev) }
>
> int quickspi_get_report(struct quickspi_device *qsdev,
> - u8 report_type, unsigned int report_id, void *buf)
> + u8 report_type, unsigned int report_id, void *buf,
> + u32 buf_len)
> {
> int rep_type;
> int ret;
> + u32 report_len;
>
> if (report_type == HID_INPUT_REPORT) {
> rep_type = GET_INPUT_REPORT;
> @@ -372,9 +374,17 @@ int quickspi_get_report(struct quickspi_device *qsdev,
> }
> qsdev->get_report_cmpl = false;
>
> - memcpy(buf, qsdev->report_buf, qsdev->report_len);
> + /* quickspi_handle_input_data() updates this from IRQ context. */
> + report_len = READ_ONCE(qsdev->report_len);
> + if (report_len > buf_len) {
> + dev_err_once(qsdev->dev, "Get report response too big, %u
> vs %u\n",
> + report_len, buf_len);
> + return -EINVAL;
> + }
> +
> + memcpy(buf, qsdev->report_buf, report_len);
>
> - return qsdev->report_len;
> + return report_len;
> }
>
> int quickspi_set_report(struct quickspi_device *qsdev, diff --git
> a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h b/drivers/hid/intel-
> thc-hid/intel-quickspi/quickspi-protocol.h
> index 775e29c1ed13..8a2338bee808 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h
> @@ -12,7 +12,7 @@ struct quickspi_device;
>
> void quickspi_handle_input_data(struct quickspi_device *qsdev, u32 buf_len);
> int quickspi_get_report(struct quickspi_device *qsdev, u8 report_type,
> - unsigned int report_id, void *buf);
> + unsigned int report_id, void *buf, u32 buf_len);
> int quickspi_set_report(struct quickspi_device *qsdev, u8 report_type,
> unsigned int report_id, void *buf, u32 buf_len); int
> quickspi_get_report_descriptor(struct quickspi_device *qsdev);
Thanks for the patch!
This is a good error handling for unexpected big receive buffer.
Reviewed-by: Even Xu <even.xu@intel.com>
> --
> 2.43.0
© 2016 - 2026 Red Hat, Inc.