RE: [PATCH 0/2] HID: intel-thc-hid: intel-quickspi: two DMA buffer overflows

[Xu, Even]

Sure, sorry for missing these.

Best Regards,
Even Xu

> -----Original Message-----
> From: Jiri Kosina <jikos@xxxxxxxxxx>
> Sent: Saturday, September 12, 2026 12:09 AM
> To: HyeongJun An <sammiee5311@xxxxxxxxx>
> Cc: Xu, Even <even.xu@xxxxxxxxx>; Sun, Xinpeng <xinpeng.sun@xxxxxxxxx>;
> Benjamin Tissoires <bentiss@xxxxxxxxxx>; linux-input@xxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; stable@xxxxxxxxxxxxxxx
> Subject: Re: [PATCH 0/2] HID: intel-thc-hid: intel-quickspi: two DMA buffer
> overflows
> 
> On Thu, 20 Aug 2026, HyeongJun An wrote:
> 
> > Two heap overflows on the QuickSPI receive path, both from a
> > controller that declares one length and sends another.
> >
> > The first is the DMA landing buffer, sized from the device descriptor
> > while the THC DMA rounds its packet size up to 4K.  The second is the
> > GET REPORT response, whose length is checked against what the DMA
> > delivered and never against report_buf.  Each has a sibling in-tree
> > that already gets it right, named in the patch.
> >
> > Neither was reproduced on hardware.  Both turned up while working on
> > commit 035ec4a71cb8 ("HID: intel-thc-hid: intel-quickspi: bound
> > GET_REPORT response to the caller buffer"), which covers neither.
> >
> > A fuller fix for the first would give thc_rxdma_read() a capacity
> > argument, but that changes a shared API and touches intel-quicki2c, so
> > this keeps to the driver.
> >
> > HyeongJun An (2):
> >   HID: intel-thc-hid: intel-quickspi: size the input buffer for the DMA
> >   HID: intel-thc-hid: intel-quickspi: bound the GET REPORT response to
> >     report_buf
> 
> Even Xu, can you please review this? Thanks,
> 
> --
> Jiri Kosina
> SUSE Labs