Commit e716edaf authored Feb 27, 2026 by Lee Jones Committed by Benjamin Tissoires Mar 17, 2026

HID: multitouch: Check to ensure report responses match the request



It is possible for a malicious (or clumsy) device to respond to a
specific report's feature request using a completely different report
ID.  This can cause confusion in the HID core resulting in nasty
side-effects such as OOB writes.

Add a check to ensure that the report ID in the response, matches the
one that was requested.  If it doesn't, omit reporting the raw event and
return early.

Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

parent f7a4c78b

drivers/hid/hid-multitouch.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -526,12 +526,19 @@ static void mt_get_feature(struct hid_device hdev, struct hid_report report)
		dev_warn(&hdev->dev, "failed to fetch feature %d\n",
		report->id);
		} else {
		/* The report ID in the request and the response should match */
		if (report->id != buf[0]) {
		hid_err(hdev, "Returned feature report did not match the request\n");
		goto free;
		}

		ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
		size, 0);
		if (ret)
		dev_warn(&hdev->dev, "failed to report feature\n");
		}

		free:
		kfree(buf);
		}