[PATCH 2/3] HID: huawei: fix missing hid_is_usb() check
From: Jann Horn <jannh@google.com>
Date: 2026-07-03 15:17:18
Also in:
lkml, stable
Subsystem:
hid core layer, the rest · Maintainers:
Jiri Kosina, Benjamin Tissoires, Linus Torvalds
to_usb_interface() can only be used on a hid_device whose parent is really
USB; uhid can create devices that identify as being on BUS_USB, but don't
actually have a USB parent.
Fix the use of to_usb_interface() without a hid_is_usb() check.
I have verified that it is currently possible to trigger a kernel splat due
to this bug in an ASAN build, and that this commit fixes the issue.
Fixes: e93faaca84b7 ("HID: huawei: fix CD30 keyboard report descriptor issue")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
---
drivers/hid/hid-huawei.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/hid-huawei.c b/drivers/hid/hid-huawei.c
index 6a616bf21b38..ee3fc6f68475 100644
--- a/drivers/hid/hid-huawei.c
+++ b/drivers/hid/hid-huawei.c@@ -44,11 +44,12 @@ static const __u8 huawei_cd30_kbd_rdesc_fixed[] = { static const __u8 *huawei_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - struct usb_interface *intf = to_usb_interface(hdev->dev.parent); + struct usb_interface *intf = hid_is_usb(hdev) ? + to_usb_interface(hdev->dev.parent) : NULL; switch (hdev->product) { case USB_DEVICE_ID_HUAWEI_CD30KBD: - if (intf->cur_altsetting->desc.bInterfaceNumber == 1) { + if (!intf || intf->cur_altsetting->desc.bInterfaceNumber == 1) { if (*rsize != sizeof(huawei_cd30_kbd_rdesc_fixed) || memcmp(huawei_cd30_kbd_rdesc_fixed, rdesc, sizeof(huawei_cd30_kbd_rdesc_fixed)) != 0) {
--
2.55.0.rc0.799.gd6f94ed593-goog