Re: [PATCH 1/3] HID: hid-google-hammer: use named initializers for acpi_device_id
From: sashiko-bot@kernel.org
Date: 2026-09-08 09:24:26
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Missing validation of `field->maxusage` before accessing `field->usage->hid`. -- commit f7c0a66497368221036f024200ddbda2e9fb80a9 Author: Pawel Zalewski [off-list ref] HID: hid-google-hammer: use named initializers for acpi_device_id Use a designated initializer for the acpi_device_id fields which makes the code more readable and consistent with how lists are initialized in the rest of the kernel code base. Also drop explicitly setting fields to 0 where it is redundant.
quoted hunk ↗ jump to hunk
diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c index c99c3c0d442e1..847b1ddefeeca 100644 --- a/drivers/hid/hid-google-hammer.c +++ b/drivers/hid/hid-google-hammer.c@@ -268,7 +268,7 @@ static void cbas_ec_remove(struct platform_device *pdev) #ifdef CONFIG_ACPI static const struct acpi_device_id cbas_ec_acpi_ids[] = { - { "GOOG000B", 0 }, + { .id = "GOOG000B" }, { } }; MODULE_DEVICE_TABLE(acpi, cbas_ec_acpi_ids);
[Severity: High]
This is a pre-existing issue, but does hammer_get_folded_state() lack validation
for the number of usages before accessing the usage array?
Looking at drivers/hid/hid-google-hammer.c:hammer_get_folded_state():
for (a = 0; a < report->maxfield; a++) {
struct hid_field *field = report->field[a];
if (field->usage->hid == HID_USAGE_KBD_FOLDED) {
u32 value = hid_field_extract(hdev, buf+1,
field->report_offset, field->report_size);
hammer_folded_event(hdev, value);
break;
}
}
If a maliciously crafted HID descriptor declares a field with 0 usages
(where field->maxusage == 0), will accessing field->usage->hid
(equivalent to field->usage[0].hid) cause an out-of-bounds memory read?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908-acpi-hid-v1-0-08df24c4b139@thegoodpenguin.co.uk?part=1