Re: [PATCH v3 5/7] HID: asus: Do not send feature reports larger than declared

[Denis Benato]

On 10/13/26 12:40, Paolo Pisati wrote:
> The keyboard backlight and Fn-lock commands are sent as 64 byte
> feature reports, the size of report 0x5a on the ROG keyboards. The
> Zenbook Duo keyboards declare feature report 0x5a with 15 data bytes,
> 16 with the report ID, and do not answer writes larger than that: the
> control transfer times out over USB and fails with -EIO over
> Bluetooth, so the backlight cannot be set, while the 16 byte handshake
> goes through.
>
> Cap feature report writes at the length the device declares for the
> report, when it declares it. hid_report_len() counts the report ID, so
> the handshake and the other commands up to that size are sent as they
> are.

This has been a huge pain in the past months for me so than you for
taking care of this.

> Assisted-by: LLM

As the others.

With comments extended (see below):

Reviewed-by: Denis Benato <denis.benato@xxxxxxxxx>

If you decide to help me and unify packets alloc between devices
you can do it on a separate patch after this one and preserve my reviewed-by.

> Signed-off-by: Paolo Pisati <p.pisati@xxxxxxxxx>
> Tested-by: Rebecca Mara Müller <rebecca.mara@xxxxxxxxx> # UX8407AA
> ---
>  drivers/hid/hid-asus.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
> index b127f5c38f60..7b17553e94b6 100644
> --- a/drivers/hid/hid-asus.c
> +++ b/drivers/hid/hid-asus.c
> @@ -632,6 +632,18 @@ static int asus_raw_event(struct hid_device *hdev,
>  
>  static int asus_kbd_set_report(struct hid_device *hdev, const u8 *buf, size_t buf_size)
>  {
> +	struct hid_report *report;
> +
> +	/*
> +	 * Do not send more than the declared size of the report, report ID
> +	 * included: the Zenbook Duo keyboards declare 15 data bytes for
> +	 * report 0x5a, 16 on the wire like the handshake, and do not answer
> +	 * the 64 byte writes sized for the ROG keyboards.
> +	 */

Maybe also mentions the majority of ROG laptops uses 64 bytes, xgm 300 bytes
and touchpads also 16 bytes as the duo.

> +	report = hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[buf[0]];
> +	if (report)
> +		buf_size = min_t(size_t, buf_size, hid_report_len(report));
> +

I think that it's worth doing this for every supported devices: rog ally,
laptops, touchpads and so on, my only question is if this code is robust
enough to handle all cases, but it's worth a try.

It's also worth adding another patch to unify all devices to use this code.

I can test on a rog xg mobile: obscure hardware that uses 300 bytes and
see if it still works.

>  	u8 *dmabuf __free(kfree) = kmemdup(buf, buf_size, GFP_KERNEL);
>  	if (!dmabuf)
>  		return -ENOMEM;