RE: [PATCH 0/2] HID: intel-thc-hid: intel-quickspi: two DMA buffer overflows

Sure, sorry for missing these.

Best Regards,
Even Xu

-----Original Message-----
From: Jiri Kosina <jikos@kernel.org>
Sent: Saturday, September 12, 2026 12:09 AM
To: HyeongJun An <redacted>
Cc: Xu, Even <even.xu@intel.com>; Sun, Xinpeng <xinpeng.sun@intel.com>;
Benjamin Tissoires [off-list ref]; linux-input@vger.kernel.org; linux-
kernel@vger.kernel.org; stable@vger.kernel.org
Subject: Re: [PATCH 0/2] HID: intel-thc-hid: intel-quickspi: two DMA buffer
overflows

On Thu, 20 Aug 2026, HyeongJun An wrote:

quoted

Two heap overflows on the QuickSPI receive path, both from a
controller that declares one length and sends another.

The first is the DMA landing buffer, sized from the device descriptor
while the THC DMA rounds its packet size up to 4K.  The second is the
GET REPORT response, whose length is checked against what the DMA
delivered and never against report_buf.  Each has a sibling in-tree
that already gets it right, named in the patch.

Neither was reproduced on hardware.  Both turned up while working on
commit 035ec4a71cb8 ("HID: intel-thc-hid: intel-quickspi: bound
GET_REPORT response to the caller buffer"), which covers neither.

A fuller fix for the first would give thc_rxdma_read() a capacity
argument, but that changes a shared API and touches intel-quicki2c, so
this keeps to the driver.

HyeongJun An (2):
  HID: intel-thc-hid: intel-quickspi: size the input buffer for the DMA
  HID: intel-thc-hid: intel-quickspi: bound the GET REPORT response to
    report_buf

Even Xu, can you please review this? Thanks,

--
Jiri Kosina
SUSE Labs