Re: [PATCH 0/2] HID: hyperv: bound initial device info descriptor

[Jiri Kosina]

On Thu, 9 Jul 2026, Michael Bommarito wrote:

> A malicious Hyper-V host or backend can crash a guest with a short
> SYNTH_HID_INITIAL_DEVICE_INFO message. mousevsc_on_receive_device_info()
> trusts the HID descriptor bLength and wDescriptorLength without checking
> that the received VMBus packet actually contains both byte ranges, so a
> truncated packet with an oversized report-descriptor length makes the
> guest read past the received packet while copying the descriptor. This
> matters most for a confidential guest, where the host is outside the trust
> boundary.

Well, untrusted host can crash the (confidential) guest in various other 
ways.

Anyway, the sanitization is good, so I've now applied it.

Thanks,

-- 
Jiri Kosina
SUSE Labs