HID: core: check field offset before dumping input

[PATCH] HID: core: check field offset before dumping input

Posted by Deepanshu Kartikey 1 month, 3 weeks ago

hid_set_field() passes field->usage + offset to hid_dump_input() before
validating offset against field->report_count. field->usage is allocated
with exactly report_count entries, so a larger offset is read out of
bounds before the existing check rejects it:

  BUG: KASAN: slab-out-of-bounds in hid_dump_input+0xcb/0xd0
  Read of size 4 at addr ffff88802ab28fc0 by task kworker/1:2/48

Move the bounds check above the hid_dump_input() call so the function
returns before the dereference.

Reported-by: syzbot+a942efa43c928a1e3daa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a942efa43c928a1e3daa
Tested-by: syzbot+a942efa43c928a1e3daa@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/hid/hid-core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index cf123347a2af..7ea1fb62b9d4 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1933,13 +1933,14 @@ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
 
 	size = field->report_size;
 
-	hid_dump_input(field->report->device, field->usage + offset, value);
-
 	if (offset >= field->report_count) {
 		hid_err(field->report->device, "offset (%d) exceeds report_count (%d)\n",
 				offset, field->report_count);
 		return -1;
 	}
+
+	hid_dump_input(field->report->device, field->usage + offset, value);
+
 	if (field->logical_minimum < 0) {
 		if (value != snto32(s32ton(value, size), size)) {
 			hid_err(field->report->device, "value %d is out of range\n", value);
-- 
2.43.0

Re: [PATCH] HID: core: check field offset before dumping input

Posted by Deepanshu Kartikey 1 month, 1 week ago

On Sun, Aug 9, 2026 at 9:36 AM Deepanshu Kartikey <kartikey406@gmail.com> wrote:
>
> hid_set_field() passes field->usage + offset to hid_dump_input() before
> validating offset against field->report_count. field->usage is allocated
> with exactly report_count entries, so a larger offset is read out of
> bounds before the existing check rejects it:
>
>   BUG: KASAN: slab-out-of-bounds in hid_dump_input+0xcb/0xd0
>   Read of size 4 at addr ffff88802ab28fc0 by task kworker/1:2/48
>
> Move the bounds check above the hid_dump_input() call so the function
> returns before the dereference.
>
> Reported-by: syzbot+a942efa43c928a1e3daa@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a942efa43c928a1e3daa
> Tested-by: syzbot+a942efa43c928a1e3daa@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/hid/hid-core.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> index cf123347a2af..7ea1fb62b9d4 100644
> --- a/drivers/hid/hid-core.c
> +++ b/drivers/hid/hid-core.c
> @@ -1933,13 +1933,14 @@ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
>
>         size = field->report_size;
>
> -       hid_dump_input(field->report->device, field->usage + offset, value);
> -
>         if (offset >= field->report_count) {
>                 hid_err(field->report->device, "offset (%d) exceeds report_count (%d)\n",
>                                 offset, field->report_count);
>                 return -1;
>         }
> +
> +       hid_dump_input(field->report->device, field->usage + offset, value);
> +
>         if (field->logical_minimum < 0) {
>                 if (value != snto32(s32ton(value, size), size)) {
>                         hid_err(field->report->device, "value %d is out of range\n", value);
> --
> 2.43.0
>

Gentle Reminder. Please let me know the status of this patch

Thanks

Deepanshu

Re: [PATCH] HID: core: check field offset before dumping input

Posted by Jiri Kosina 2 weeks, 3 days ago

On Fri, 21 Aug 2026, Deepanshu Kartikey wrote:

> > hid_set_field() passes field->usage + offset to hid_dump_input() before
> > validating offset against field->report_count. field->usage is allocated
> > with exactly report_count entries, so a larger offset is read out of
> > bounds before the existing check rejects it:
> >
> >   BUG: KASAN: slab-out-of-bounds in hid_dump_input+0xcb/0xd0
> >   Read of size 4 at addr ffff88802ab28fc0 by task kworker/1:2/48
> >
> > Move the bounds check above the hid_dump_input() call so the function
> > returns before the dereference.
> >
> > Reported-by: syzbot+a942efa43c928a1e3daa@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=a942efa43c928a1e3daa
> > Tested-by: syzbot+a942efa43c928a1e3daa@syzkaller.appspotmail.com
> > Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> > ---
> >  drivers/hid/hid-core.c | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> > index cf123347a2af..7ea1fb62b9d4 100644
> > --- a/drivers/hid/hid-core.c
> > +++ b/drivers/hid/hid-core.c
> > @@ -1933,13 +1933,14 @@ int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
> >
> >         size = field->report_size;
> >
> > -       hid_dump_input(field->report->device, field->usage + offset, value);
> > -
> >         if (offset >= field->report_count) {
> >                 hid_err(field->report->device, "offset (%d) exceeds report_count (%d)\n",
> >                                 offset, field->report_count);
> >                 return -1;
> >         }
> > +
> > +       hid_dump_input(field->report->device, field->usage + offset, value);
> > +
> >         if (field->logical_minimum < 0) {
> >                 if (value != snto32(s32ton(value, size), size)) {
> >                         hid_err(field->report->device, "value %d is out of range\n", value);
> > --
> > 2.43.0
> >
> 
> Gentle Reminder. Please let me know the status of this patch

I believe this was already fixed in 7.3 via a13cdb19fcb2.

-- 
Jiri Kosina
SUSE Labs