linux-kernel - Re: [PATCH] HID: validate report length and constants

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e2db2ad2b8bb21916a22695191e7763c@davidebeatrici.dev>
Date: Fri, 12 Dec 2025 07:22:27 +0100
From: Davide Beatrici <me@...idebeatrici.dev>
To: Benjamin Tissoires <bentiss@...nel.org>
Cc: Terry Junge <linuxhid@...micgizmosystems.com>,
 linux-kernel@...r.kernel.org, linux-input@...r.kernel.org, jikos@...nel.org,
 benjamin.tissoires@...hat.com
Subject: Re: [PATCH] HID: validate report length and constants

> IMO, the simplest is the HID-BPF route, as it's a matter of going to 
> the
> udev-hid-bpf project [1], add your program in the testing dir, and
> submit a merge request. This way your device will be fixed and I'll
> eventually take care of putting the HID-BPF program in
> drivers/hid/bpf/progs so it gets installed in all distributions.

I apologize for the delay, I had to figure out why OpenMandriva's kernel 
was
not exposing the hid_bpf_ops structure.

Turns out CONFIG_HID_BPF had to be enabled and CONFIG_FUNCTION_TRACER 
too.

Here's the merge request for udev-hid-bpf:
https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/212

> have a new kernel driver for this device which maps to .raw_event()
> and rejects reports of size 1.

I actually just realized my previous mouse, a Kysona M600, has a 
specific
driver (hid-kysona) that seemingly handles battery status reports.

That may be the cause for it randomly stopping registering clicks and 
scrolls
until it is moved (i.e. registers a movement).

But that's a story for another thread!

I wonder if we can put together a single universal driver for these 
devices...