Lee Jones a3c57a60ce HID: multitouch: Check to ensure report responses match the request ...

[ Upstream commit e716edafedad4952fe3a4a273d2e039a84e8681a ]

It is possible for a malicious (or clumsy) device to respond to a
specific report's feature request using a completely different report
ID.  This can cause confusion in the HID core resulting in nasty
side-effects such as OOB writes.

Add a check to ensure that the report ID in the response, matches the
one that was requested.  If it doesn't, omit reporting the raw event and
return early.

Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>

2026-05-07 10:55:22 +02:00

..

i2c-hid

HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up

2024-05-02 16:17:14 +02:00

intel-ish-hid

HID: intel-ish-hid: Reset enum_devices_done before enumeration

2026-02-20 13:22:35 +08:00

usbhid

HID: usbhid: paper over wrong bNumDescriptor field

2026-02-20 13:22:29 +08:00

hid-a4tech.c

…

hid-accutouch.c

…

hid-alps.c

…

hid-apple.c

HID: apple: Add 2021 magic keyboard FN key mapping

2024-02-23 08:12:53 +01:00

hid-appleir.c

HID: appleir: Fix potential NULL dereference at raw event handle

2025-04-04 11:11:29 +02:00

hid-asus.c

HID: asus: fix UAF via HID_CLAIMED_INPUT validation

2025-09-22 10:17:53 +02:00

hid-aureal.c

…

hid-axff.c

…

hid-belkin.c

…

hid-betopff.c

…

hid-cherry.c

…

hid-chicony.c

…

hid-cmedia.c

…

hid-core.c

HID: core: Harden s32ton() against conversion to 0 bits

2026-01-29 12:09:36 +08:00

hid-corsair.c

…

hid-cougar.c

HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup

2024-09-12 11:02:54 +02:00

hid-cp2112.c

hid: cp2112: Fix duplicate workqueue initialization

2023-11-20 10:29:19 +01:00

hid-cypress.c

…

hid-debug.c

HID: fix HID device resource race between HID core and debugging support

2023-12-08 08:43:23 +01:00

hid-dr.c

…

hid-elan.c

…

hid-elecom.c

…

hid-elo.c

…

hid-emsff.c

…

hid-ezkey.c

…

hid-gaff.c

…

hid-gembird.c

…

hid-generic.c

…

hid-gfrm.c

…

hid-google-hammer.c

…

hid-gt683r.c

…

hid-gyration.c

…

hid-holtek-kbd.c

HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event

2023-10-25 11:16:55 +02:00

hid-holtek-mouse.c

…

hid-holtekff.c

…

hid-hyperv.c

HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()

2025-07-17 10:08:05 +02:00

hid-icade.c

…

hid-ids.h

HID: multitouch: add eGalaxTouch EXC3188 support

2026-04-12 13:56:47 +08:00

hid-input.c

…

hid-ite.c

…

hid-jabra.c

…

hid-kensington.c

…

hid-keytouch.c

…

hid-kye.c

…

hid-lcpower.c

…

hid-led.c

…

hid-lenovo.c

…

hid-lg2ff.c

…

hid-lg3ff.c

…

hid-lg4ff.c

…

hid-lg4ff.h

…

hid-lg.c

…

hid-lg.h

…

hid-lgff.c

…

hid-logitech-dj.c

…

hid-logitech-hidpp.c

HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect

2023-10-25 11:16:20 +02:00

hid-magicmouse.c

HID: magicmouse: Do not crash on missing msc->input

2026-04-12 13:56:50 +08:00

hid-mf.c

…

hid-microsoft.c

…

hid-monterey.c

…

hid-multitouch.c

HID: multitouch: Check to ensure report responses match the request

2026-05-07 10:55:22 +02:00

hid-nti.c

…

hid-ntrig.c

HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()

2025-09-22 10:17:53 +02:00

hid-ortek.c

…

hid-penmount.c

…

hid-petalynx.c

…

hid-picolcd_backlight.c

…

hid-picolcd_cir.c

…

hid-picolcd_core.c

…

hid-picolcd_debugfs.c

…

hid-picolcd_fb.c

…

hid-picolcd_lcd.c

…

hid-picolcd_leds.c

…

hid-picolcd.h

…

hid-pl.c

HID: hid-pl: handle probe errors

2026-04-12 13:56:50 +08:00

hid-plantronics.c

HID: plantronics: Workaround for an unexcepted opposite volume key

2024-11-08 16:19:18 +01:00

hid-primax.c

…

hid-prodikeys.c

HID: prodikeys: Check presence of pm->input_ep82

2026-04-12 13:56:50 +08:00

hid-quirks.c

HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)

2026-02-20 13:22:35 +08:00

hid-redragon.c

…

hid-retrode.c

…

hid-rmi.c

…

hid-roccat-arvo.c

…

hid-roccat-arvo.h

…

hid-roccat-common.c

…

hid-roccat-common.h

…

hid-roccat-isku.c

…

hid-roccat-isku.h

…

hid-roccat-kone.c

…

hid-roccat-kone.h

…

hid-roccat-koneplus.c

…

hid-roccat-koneplus.h

…

hid-roccat-konepure.c

…

hid-roccat-kovaplus.c

…

hid-roccat-kovaplus.h

…

hid-roccat-lua.c

…

hid-roccat-lua.h

…

hid-roccat-pyra.c

…

hid-roccat-pyra.h

…

hid-roccat-ryos.c

…

hid-roccat-savu.c

…

hid-roccat-savu.h

…

hid-roccat.c

…

hid-saitek.c

…

hid-samsung.c

…

hid-sensor-custom.c

…

hid-sensor-hub.c

HID: hid-sensor-hub: don't use stale platform-data on remove

2025-04-03 10:09:50 +02:00

hid-sjoy.c

…

hid-sony.c

…

hid-speedlink.c

…

hid-steam.c

…

hid-steelseries.c

…

hid-sunplus.c

…

hid-tivo.c

…

hid-tmff.c

…

hid-topseed.c

…

hid-twinhan.c

…

hid-uclogic.c

HID: uclogic: Correct devm device reference for hidinput input_dev name

2026-02-23 10:51:47 +08:00

hid-udraw-ps3.c

…

hid-waltop.c

…

hid-wiimote-core.c

…

hid-wiimote-debug.c

…

hid-wiimote-modules.c

…

hid-wiimote.h

…

hid-xinmo.c

…

hid-zpff.c

…

hid-zydacron.c

…

hidraw.c

…

Kconfig

…

Makefile

…

uhid.c

…

wacom_sys.c

HID: wacom: fix kobject reference count leak

2025-08-13 09:44:36 +02:00

wacom_wac.c

HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

2026-05-07 10:55:22 +02:00

wacom_wac.h

…

wacom.h

…