USBX host hid mouse cause memory fault when using Logitech PRO X SUPERLIGHT mouse

[xuzihan351]

Here is part of the Logitech PRO X SUPERLIGHT report descriptor:

Note the Vendor-Defined 1 Usage Page has Report Count(5) and INPUT abs Ary data. But USBX alloc only ONE item for that. That makes memory out of bounds and thus lead to memory fault occur. When deal with the report descriptors, USBX treat that as one item becase it don't have a Usage Maximum. USBX use Usage Maximum to calc the ary item count, I don't know whether this is normative. Why not use Report Size and Report Count?

[xiaocq2001]

Thanks for the feedback, we will check that.

[xiaocq2001]

Simulated with the HID descriptor, enumeration seems good, can you give more details on how to reproduce the issue?

[xuzihan351]

There is indeed no problem with the enumeration process here. The problem will occur in the message parsing the interrupt endpoint.I will send the message of the interrupt endpoint later.

[xuzihan351]

The client buffer addr is 0x41c06e50 and its size is 0xA8, so its range is [0x41c06e50, 0x41C06EF8]. But when decompress, usbx try to write 0x41c06f00 which is a memory out of bounds. Here is the log: _ux_host_class_hid_transfer_request_completed 204 alloc client buffer addr(0x41c06e50) size(0xA8) _ux_host_class_hid_report_decompress raw data: 00 00 00 00 00 00 00 00 01 93 40 00 00 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90001) to 0x41c06e50, filed value(0x0) to 0x41c06e54 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90002) to 0x41c06e58, filed value(0x0) to 0x41c06e5c _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90003) to 0x41c06e60, filed value(0x0) to 0x41c06e64 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90004) to 0x41c06e68, filed value(0x0) to 0x41c06e6c _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90005) to 0x41c06e70, filed value(0x0) to 0x41c06e74 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90006) to 0x41c06e78, filed value(0x0) to 0x41c06e7c _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90007) to 0x41c06e80, filed value(0x0) to 0x41c06e84 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90008) to 0x41c06e88, filed value(0x0) to 0x41c06e8c _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90009) to 0x41c06e90, filed value(0x0) to 0x41c06e94 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x9000a) to 0x41c06e98, filed value(0x0) to 0x41c06e9c _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x9000b) to 0x41c06ea0, filed value(0x0) to 0x41c06ea4 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x9000c) to 0x41c06ea8, filed value(0x0) to 0x41c06eac _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x9000d) to 0x41c06eb0, filed value(0x0) to 0x41c06eb4 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x9000e) to 0x41c06eb8, filed value(0x0) to 0x41c06ebc _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x9000f) to 0x41c06ec0, filed value(0x0) to 0x41c06ec4 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x90010) to 0x41c06ec8, filed value(0x0) to 0x41c06ecc _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x10030) to 0x41c06ed0, filed value(0x0) to 0x41c06ed4 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x10031) to 0x41c06ed8, filed value(0x0) to 0x41c06edc _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0x10038) to 0x41c06ee0, filed value(0x0) to 0x41c06ee4 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0xc0238) to 0x41c06ee8, filed value(0x0) to 0x41c06eec _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0xff000001) to 0x41c06ef0, filed value(0x1) to 0x41c06ef4 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0xff000093) to 0x41c06ef8, filed value(0x93) to 0x41c06efc _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0xff000040) to 0x41c06f00, filed value(0x40) to 0x41c06f04 _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0xff000000) to 0x41c06f08, filed value(0x0) to 0x41c06f0c _ux_host_class_hid_field_decompress 148 decompress hid data, write field usage(0xff000000) to 0x41c06f10, filed value(0x0) to 0x41c06f14

[xiaocq2001]

Thanks for the logs. Please try to change code here: https://github.com/azure-rtos/usbx/blob/7c928b43db68b72970b3effd5a2582eb5a6869c7/common/usbx_host_classes/src/ux_host_class_hid_report_add.c#L199, the number of items to decompress is not related to item type.

    /* Get the number of fields for this report.  */
    hid_field_count =  hid_parser -> ux_host_class_hid_parser_global.ux_host_class_hid_global_item_report_count;

[xuzihan351]

This works. Thank you.

[xiaocq2001]

Fix already in latest code. Can close.