linux-kernel - Re: [PATCH] HID: validate report length and constants

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9e44de7bab6967a200d7404ebb068071@davidebeatrici.dev>
Date: Tue, 02 Dec 2025 22:54:26 +0100
From: Davide Beatrici <me@...idebeatrici.dev>
To: Terry Junge <linuxhid@...micgizmosystems.com>
Cc: Benjamin Tissoires <bentiss@...nel.org>, linux-kernel@...r.kernel.org,
 linux-input@...r.kernel.org, jikos@...nel.org, benjamin.tissoires@...hat.com
Subject: Re: [PATCH] HID: validate report length and constants

> Can you supply the Device, Configuration, and Report Descriptors?

Sure.

Device Descriptor:
   idVendor           0x373b Compx
   idProduct          0x1107 ATK X1 SE Nearlink
   bcdDevice          1.21
   bcdUSB             2.00
   bMaxPacketSize0    64
   iManufacturer      1 Compx
   iProduct           2 ATK X1 SE Nearlink
   bNumConfigurations 1

Configuration Descriptor:
   wTotalLength       0x0054
   bNumInterfaces     3
   bmAttributes       0xa0 (Bus Powered, Remote Wakeup)
   MaxPower           494mA

Interface 0: HID Keyboard
   HID Descriptor: wDescriptorLength 77
   Endpoint IN 0x81, Interrupt, 64 bytes

Interface 1: HID (non‑boot)
   HID Descriptor: wDescriptorLength 156
   Endpoint IN 0x82, Interrupt, 64 bytes

Interface 2: HID Mouse
   HID Descriptor: wDescriptorLength 87
   Endpoint IN 0x83, Interrupt, 64 bytes

Report Descriptors:

Interface 2 (Mouse):
   05 01 09 02 A1 01 09 01 A1 00 05 09 19 01 29 05
   15 00 25 01 95 05 75 01 81 02 95 01 75 03 81 01
   05 01 09 30 09 31 16 00 80 26 FF 7F 75 10 95 02
   81 06 C0 A1 00 05 01 09 38 15 81 25 7F 75 08 95
   01 81 06 C0 A1 00 05 0C 0A 38 02 95 01 75 08 15
   81 25 7F 81 06 C0 C0

Interface 1 (HID composite):
   05 0C 09 01 A1 01 85 05 15 00 26 14 05 19 00 2A
   14 05 75 10 95 01 81 00 C0 05 01 09 80 A1 01 85
   03 19 81 29 83 15 00 25 01 95 03 75 01 81 02 95
   01 75 05 81 01 C0 05 01 09 06 A1 01 85 04 05 07
   15 00 25 01 19 00 29 9F 95 A0 75 01 81 02 C0 06
   02 FF 09 02 A1 01 85 13 15 00 26 FF 00 75 08 95
   13 09 02 81 00 09 02 91 00 C0 06 02 FF 09 02 A1
   01 85 08 15 00 26 FF 00 75 08 95 10 09 02 81 00
   09 02 91 00 C0 06 04 FF 09 02 A1 01 85 06 09 02
   15 00 26 FF 00 75 08 95 07 B1 02 C0

Interface 0 (Keyboard):
   05 01 09 06 A1 01 05 08 19 01 29 03 15 00 25 01
   75 01 95 03 91 02 95 05 91 01 05 07 19 E0 29 E7
   15 00 25 01 75 01 95 08 81 02 75 08 95 01 81 01
   05 07 19 00 2A FF 00 15 00 26 FF 00 75 08 95 05
   81 00 05 FF 09 03 75 08 95 01 81 02 C0