[PATCH 0/9] HID: Hardening report validation and unnumbered report handling

[Dmitry Torokhov]

This series improves validation and consistency across HID core,
transport drivers, and individual device drivers for numbered and
unnumbered reports.

Bluetooth HIDP and HID core report retrieval handling are updated to
properly respect the kernel convention where raw report request buffers
reserve the first byte for the report ID, using 0 for unnumbered
reports.

Report descriptors mixing numbered and unnumbered reports within the
same report enumeration are rejected in accordance with the HID
specification.

Report ID verification for successful report retrieval transfers is
centralized in the HID core, with a new device quirk to accommodate
buggy firmware (such as the ASUS ROG Flow Z13 touchpad). Redundant
report ID checks are removed across the I2C-HID, Goodix SPI, Intel
QuickI2C, multitouch, and PlayStation drivers.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
---
Dmitry Torokhov (9):
      Bluetooth: HIDP: Fix GET_REPORT and SET_REPORT for unnumbered reports
      HID: core: Fix GET_REPORT input processing for unnumbered reports
      HID: core: Reject mixing numbered and unnumbered reports
      HID: core: Validate GET_REPORT report ID centrally
      HID: i2c-hid: Drop redundant report ID validation
      HID: goodix-spi: Drop redundant report ID validation
      HID: intel-thc-hid: Drop redundant report ID validation in quicki2c
      HID: multitouch: Drop redundant report ID validation in mt_get_feature
      HID: playstation: Drop redundant report ID validation in ps_get_report

 drivers/hid/hid-core.c                             | 26 ++++++++++++++++--
 drivers/hid/hid-goodix-spi.c                       |  5 ----
 drivers/hid/hid-multitouch.c                       | 32 ----------------------
 drivers/hid/hid-playstation.c                      |  5 ----
 drivers/hid/hid-quirks.c                           |  2 ++
 drivers/hid/i2c-hid/i2c-hid-core.c                 |  7 -----
 .../intel-quicki2c/quicki2c-protocol.c             |  6 ++--
 include/linux/hid.h                                |  2 ++
 net/bluetooth/hidp/core.c                          | 29 ++++++++++++++++----
 9 files changed, 53 insertions(+), 61 deletions(-)
---
base-commit: b018686719706a781c45a874ed51374a2dc4b767
change-id: 20261012-hid-core-report-validation-8ca85d385ca7

Thanks.

-- 
Dmitry