[PATCH v2 0/3] DO-NOT-MERGE: HID: mcp2221: stop device IO before hid_hw_stop and fix UAF/OOB-read

[Jiangshan Yi]

This series revisits the "stop device IO before hid_hw_stop" v1
submission and, while reviewing it, fixes two pre-existing security
issues in the same driver.

Patch 1 is v2 of the original single-patch submission. v1 added an
unconditional hid_device_io_stop() to the devm cleanup callback, which
prints a spurious "io already stopped" warning on normal device
removal: hid_device_remove() clears io_started before the devres group
is released, so the callback always sees io_started == false. v2 guards
the call with io_started so it only runs on the probe-failure path that
actually needs to balance hid_device_io_start().

Patches 2 and 3 are independent, pre-existing bugs (both dating back to
the driver's introduction in 67a95c21463d) that the Sashiko AI review
flagged while reviewing v1. They are self-contained, each carries its
own Fixes: tag for -stable, and neither depends on patch 1 or on each
other:

  * Patch 2 - mcp->rxbuf is left dangling after an I2C/SMBus transfer
    completes or times out; a delayed or spurious report can then write
    device data into the freed buffer (write use-after-free).
  * Patch 3 - mcp2221_raw_event() never validates the report size and
    trusts data[3] as the copy length, so a malicious short report can
    leak uninitialized kernel memory back through the I2C read path.

The original v1 submission is available at:
https://lore.kernel.org/r/20260728061919.310367-1-yijiangshan@xxxxxxxxxx

Signed-off-by: Jiangshan Yi <yijiangshan@xxxxxxxxxx>

Jiangshan Yi (3):
  HID: mcp2221: stop device IO before hid_hw_stop
  HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
  HID: mcp2221: validate report size in mcp2221_raw_event()

 drivers/hid/hid-mcp2221.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

--
2.25.1