From nobody Sun May 24 17:48:10 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B7C3397AFF for ; Sun, 24 May 2026 13:52:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779630731; cv=none; b=LMz+DNPV0UD9g9dxfizlspWSEcWa3p1El14oO+7IJOyvYukPb6XBOucW4jQBHvSUTQe5ZpzKHLzkoCr+usNRsOA9OhFijB38Xn2ocsdGE3GkeClNRipxH6GA/7qGeKIrJ1DYz8YMwKZiImDKFw1v8wEp9XHQe6UAbqHLkI9PKT8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779630731; c=relaxed/simple; bh=ZgbH/mYUb/Nhi5/awpSI/okcaOUUQIeFVWLGt9Vv3fo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=k8d/HuXiNtBs9OOQDlRlIW5nb5ZTbc8ppwi5tt9LguGnGAdAUspiPyfEIZU1FdKAoWX8+nsk7JTh2Cngd/xYnHIb+VO3uM/wGy6Mk8A5YG3OdVD651F2ao6lXTZdZufT5DJZboqR4riK78xBxHYLZ4zDYfT3XnoZpnvZDst8NGA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=GyY+gvSV; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="GyY+gvSV" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-36931e4f5e8so8110426a91.2 for ; Sun, 24 May 2026 06:52:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779630730; x=1780235530; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=GDBQfFLHNH4Mc08Xf81Bh0XesibRVNF/v0oW8QDjjcY=; b=GyY+gvSV2MWdyLkCMLNrPgL5l+9X3MT/lCy5Gj5rIYWufcjttEoU4txXApyV/pLGIy eg7s4Vd5zp7CFz+1d4PwFJzb7PuxvnKg+T9lMT6IKjsZZj34FKzTeJ3Gm6JM9tJPyix6 dVa+Pnr4bz1VpJ9rVR14rDmp7kpm5zEM0UIwLI4fK+e9iwCbirdJUkhn+v4zRiO1w8tL b77n9HpQ1z447urws8H2EBemvGLe2b4BhmejFjcAnjQbwIFTS8cjitgGB3xSkP/03Fpv qO/sicmX/D5Ag0fC8IIUWlZvQoIabW2GxPsE1KZUgj5pC3rj3THBbU3BN3t0/1/jpAJM SyaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779630730; x=1780235530; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=GDBQfFLHNH4Mc08Xf81Bh0XesibRVNF/v0oW8QDjjcY=; b=fBEa3nICBMyWy9bZc0ms2+pKYIn0ChWEknEl/RImh8yQxiI4p+7d5rjVXuRPL3y2PY DMwRTyDyXuSqIWf9U1dJ3AVcn4vBxID3c3fnsDu5KAKdEw4lX2gO+hKnj6Jih6YONvpW GaPYcC8TS9qTr9KGAZKDHtvijkoueDmbX9x7dDUa/o2C6dMmBHwJpSV7k8hWs05mGaZ8 CsN9byr8Q1Qj15026qsiOw2PZDpIwtMqDlBJfxoiOD/Em8HtOc0iD6and1lQ5PiUOMtA I8KRmJN1Fa2eFmmhmxZWs1bCaOF+O/KOQ2t7p2elnp2NrhYmF7jkdCS9BJGLHfXspcB3 51gg== X-Forwarded-Encrypted: i=1; AFNElJ/RDvzWF1NI9ZYFVnuigHcHAwdLvSbJwjeGuK0XIsAxaLitMAMd7KyAgzxD2rV50i6RAry5zI6DNMpVA3s=@vger.kernel.org X-Gm-Message-State: AOJu0YxmvS2YLtPszZu6euywloxtcDroFD7ZEeKdRCF6iNMRmykLe2JI VTSi3Bm09ypaFQtiejuHcGHe4rp3+KSod7pnBo6SwkWu7NH5ng0UBBif X-Gm-Gg: Acq92OHoRf/aZst0s/j230vXhDyyVebEOKKOuC8/LgUp4lWRavqcfkhr3AAplTK+kao jfmFVKCap1SvBrmv6455zBiJNQd1XQzr3vbQsmwe0UxFfVu0NPdJYFFBxWIWcdGbgA36PKwAxYb 8gUrQIIKlr1Hw3km8QtkVmw2fN/Mnm5nxTc8N8bu87O6qZv0nVW5p0wZzZwwxNPXd3rdIZwcCp+ trnaEdwHjEOIXaZCSec+ct+9UjCEQUtHpAYmymaIz5zuRxOr6u48jqeuQTPVQSqraEInYpHElJJ 5FLXpxSovnopVLME4LHRPKcOV4uHIQFQtXjISoPYRDkmNNoSgY+a8W3lfyeQzB1McRgTHO3ZJAO DAtLbn+k1NnKZJG84AVDeluyZKofyJQuMAw4R6IWKSfzAxcsS6qwJ741jBgslA2TzOTdGYYSD6R rZLU3j33VHmNoZo6AnaLE9oqw0kFXzwP4BRNpUiY1swfwrAYZu X-Received: by 2002:a17:90a:c110:b0:368:341a:a925 with SMTP id 98e67ed59e1d1-36a67616959mr11020845a91.23.1779630729720; Sun, 24 May 2026 06:52:09 -0700 (PDT) Received: from jmoon ([118.220.156.4]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36a72c4ca35sm7073833a91.9.2026.05.24.06.52.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 24 May 2026 06:52:09 -0700 (PDT) From: Jinmo Yang To: Jason Gerecke , Ping Cheng Cc: Jinmo Yang , Jiri Kosina , Benjamin Tissoires , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 1/1] HID: wacom: validate report size before kfifo insert Date: Sun, 24 May 2026 22:52:03 +0900 Message-ID: <20260524135203.1996265-2-jinmo44.yang@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260524135203.1996265-1-jinmo44.yang@gmail.com> References: <20260524135203.1996265-1-jinmo44.yang@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" wacom_wac_queue_insert() passes the report size directly to kfifo_in() without checking whether the report fits in the kfifo buffer. Since commit 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit"), the kfifo is sized dynamically as min(PAGE_SIZE, 10 * pktlen), which can be as small as 256 bytes. However, reports received via UHID_INPUT2 can be up to UHID_DATA_MAX (4096) bytes. When such an oversized report reaches wacom_wac_queue_insert(), the existing kfifo_avail() loop cannot make room for a record larger than the total buffer, causing kfifo_copy_in() to memcpy up to 3840 bytes past the slab allocation. Add a size check at the top of wacom_wac_queue_insert() to reject reports that exceed the kfifo capacity. Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit") Cc: stable@vger.kernel.org Signed-off-by: Jinmo Yang --- drivers/hid/wacom_sys.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index a32320b..cc82c6f 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -54,6 +54,12 @@ static void wacom_wac_queue_insert(struct hid_device *hd= ev, { bool warned =3D false; =20 + if (size > kfifo_size(fifo)) { + hid_warn(hdev, "%s: report too large (%d > %u) for kfifo\n", + __func__, size, kfifo_size(fifo)); + return; + } + while (kfifo_avail(fifo) < size) { if (!warned) hid_warn(hdev, "%s: kfifo has filled, starting to drop events\n", __fun= c__); --=20 2.53.0