From nobody Fri Apr 3 10:04:16 2026 Received: from mail-ua1-f42.google.com (mail-ua1-f42.google.com [209.85.222.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC09A349B1D for ; Tue, 24 Mar 2026 20:19:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774383546; cv=none; b=ZMXFkFyxtbrdhgdLVE+W7vm03FNgK0Es3d20cClr0e3M/10HMzwPYFHZQRC+85H/5n59xN3xEfIe7jyYIbNhGvIFqlN2IXsc2ghUjXBwtkgPZQpxMLpIDF5+tA2kz7IOWwUN3AvNXBcykqlgRCLhtmiSVuUs8TQn3C+kvXPffVw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774383546; c=relaxed/simple; bh=Dyg46i6NCc1WhVwi8ovx5dhpXtlJuvYJqgKq6QPv0Pc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DdVKeDgk2iJLfDn0hL4RP5K2b82MWIxbfFZOG/VbFTydduUspVviyjZuDcPoqO5H3Fv1O9Q2ieL493G2njiE3SQzyds0oubl2CbTXWXPNWOxZYNWrvI64LRs6vQVpBNRSyq4BH2LZWRDSsnk5KM8BBTOrPf78dsyqwqA9xfoYKs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=e6vCoVf1; arc=none smtp.client-ip=209.85.222.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="e6vCoVf1" Received: by mail-ua1-f42.google.com with SMTP id a1e0cc1a2514c-94e578a0fa5so837815241.0 for ; Tue, 24 Mar 2026 13:19:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1774383544; x=1774988344; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=c/LwkGsCAcMgkIjG5Z0vM08NnZ6ybKA3EObcdXRbB+Q=; b=e6vCoVf12gK9VWthRMn61bBa/NccVDO0jp6+PjF+1gUG5lfxCW6Lloo3qiTgcbzK7o UWAtpQ9YKK28PesKG0rLIAedXyI/0nD1swFFk6XPzyl2mBdcb3seQOz3nEhdf4bZq9uB EGmF2C+5lfuGxGxTL3WIZq5wH0V092DYfTyuaYnC6oL5iXbypLgE305y0Y4m6mHrcc6f 3nzxCMRssTptHAgaolWDwMolk+l6XgqgJFCabVIgG0i24QbVuC/oWc5Ke/tpCLlxPW3K 24OArcrdEiHivf4LCu7yZG6D0xrVagMIRTvdogvgB6wtzFA6XroaH2xmI70oJZAU5RQC yaTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774383544; x=1774988344; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=c/LwkGsCAcMgkIjG5Z0vM08NnZ6ybKA3EObcdXRbB+Q=; b=YSjLBn36H5qEIrLa7/dZCiufn2avr5DRTCSIByGrCM0CpkWv1pQJWCztQBKURBnaL8 4svlW0UpfsL+mrvf2oPFBjvAduZ7w1Bs/nJVoRvyc5yds33339YNIFsy6Hs2w5nP6JfI VwyZXWJgc0cmsg+CMAjYXATxZfHrm4qFUXgFks3OEjz+Efsx1pV6U5vzl4y4PAk7aAZ3 Bs/UprnZF3XTOgMefllDezi30vlAHbWWTWPmzOlKP/3IqI4C9ox8AzzqxkzSHHUgGV12 mY5B2pqf8iWB6nJGCtQTsPz0fpehFMMG9tluP43fSbe0G1wijKxxHYC/Is67qhBNrOma oDwQ== X-Forwarded-Encrypted: i=1; AJvYcCUcQ2AlDOtknuCZH1tzUJ2G6J8uuP+aSgHj2uFLR4jck/PyR7q7MNZjmfY3HZ1dhRkMAQfe7fx94LlZqIU=@vger.kernel.org X-Gm-Message-State: AOJu0YwQ1TQ06jrKGuOreKnlPNpa0nM2BgddvZx6VQA1kqvFsmdptsEz h2ut3Ay96FRnflPeFnAFCjUs78gReu9FlkUdK7SVRPuzZxZtYzeLtzCo X-Gm-Gg: ATEYQzxrRragaC6uesvgJ8zR9kt+0fnqG9I7HOCeVlDWWYUbtBfMpaHFx+uuvxwFQf0 BLOXXkolZndx+/OmrD/rM+KfHxkBWJB/Q5yMd8zIO/sqm3H96R62yeSUKYSMBdzR5vaE9jb6FHx yhEn3o6sCrYnCuHbNSoKKyJaDpUXNXB8wAIGbqw4Pyd6aGyZxqErqiSNW/CXsAMzdlrLLGLE5G5 r8oOLx3Zi4jdE7l8oKOGILtMiClYM6VF31rE9QypcKaqMrxnP3pF7r5G3lOuBkLib1Y6cbbfoAi 7udus1WjSORcdxzN0SEUCdKXw8AiwdB+oN5sgk3oDr9IrUq70yAYOgbrBCI3xFcwJBkRe3PLn2G f9M+dTgWY9NgZvEY/uxtLzNvqMpcPBNrI5d8hHtVAUvKq02MZ03OU6ckeIvSheFnN5rj1FegW/y T1FuFxmdGc0chI0dM3rn7iw2hZPTdXSVIYTg== X-Received: by 2002:a05:6102:4425:b0:602:a4af:5fe with SMTP id ada2fe7eead31-603870b6353mr706587137.9.1774383543988; Tue, 24 Mar 2026 13:19:03 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac6:d6dd:aa::11:17b]) by smtp.gmail.com with ESMTPSA id ada2fe7eead31-602b549fff7sm11665211137.7.2026.03.24.13.19.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 24 Mar 2026 13:19:03 -0700 (PDT) From: Sebastian Josue Alba Vives To: michael.zaidman@gmail.com, jikos@kernel.org, bentiss@kernel.org Cc: linux-i2c@vger.kernel.org, linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Sebastian Josue Alba Vives Subject: [PATCH v2] HID: ft260: validate report size and payload length in raw_event Date: Tue, 24 Mar 2026 14:18:58 -0600 Message-ID: <20260324201858.46591-1-sebasjosue84@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260324173527.11321-1-sebasjosue84@gmail.com> References: <20260324173527.11321-1-sebasjosue84@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ft260_raw_event() casts the raw data buffer to a ft260_i2c_input_report struct and accesses its fields without validating the size parameter. Since __hid_input_report() invokes the driver's raw_event callback before hid_report_raw_event() performs its own report-size validation, a device sending a truncated HID report can cause out-of-bounds heap reads. Additionally, even with a full-sized report, a corrupted xfer->length field can cause memcpy to read beyond the report buffer. The existing check only validates against the destination buffer size, not the source data available in the report. Add two checks: reject reports shorter than FT260_REPORT_MAX_LENGTH, and verify that xfer->length does not exceed the actual data available in the report. Log warnings to aid debugging. Cc: stable@vger.kernel.org Signed-off-by: Sebastian Josue Alba Vives --- drivers/hid/hid-ft260.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/hid/hid-ft260.c b/drivers/hid/hid-ft260.c index 333341e80..68008a423 100644 --- a/drivers/hid/hid-ft260.c +++ b/drivers/hid/hid-ft260.c @@ -1068,6 +1068,17 @@ static int ft260_raw_event(struct hid_device *hdev, = struct hid_report *report, struct ft260_device *dev =3D hid_get_drvdata(hdev); struct ft260_i2c_input_report *xfer =3D (void *)data; =20 + if (size < FT260_REPORT_MAX_LENGTH) { + hid_warn(hdev, "short report: %d\n", size); + return 0; + } + + if (xfer->length > size - offsetof(struct ft260_i2c_input_report, data)) { + hid_warn(hdev, "payload %d exceeds report size %d\n", + xfer->length, size); + return 0; + } + if (xfer->report >=3D FT260_I2C_REPORT_MIN && xfer->report <=3D FT260_I2C_REPORT_MAX) { ft260_dbg("i2c resp: rep %#02x len %d\n", xfer->report, --=20 2.43.0