From nobody Fri Oct 2 04:46:28 2026 Received: from fhigh-b3-smtp.messagingengine.com (fhigh-b3-smtp.messagingengine.com [202.12.124.154]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E4BCC417D8C; Wed, 5 Aug 2026 09:56:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.154 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785923804; cv=none; b=Puuyl+0sGsIHSLJG/72WMVC+Y2azC2WaTYV+bf5sym7qKZBBF92A8qpoqDKhqaWmCpJ/7VZKAmU28Ks5pRP+t6QOc8BtKFl0LFjuU+1SWYKW6PYIyyJpqNYYq0Xow5q6mD1CqAi/UzDEHC3z23WyIdSRJybIYSOaUgPG3y4gsOU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785923804; c=relaxed/simple; bh=PCULd3aOCMPWlFtJNldzCFrdhWkCSzV7ap70zn+oqvE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=uh0fem0z3r38i4GX0Zn6jdH2t6XWcS1rt0cveYxaZhG2lj/tTVxzfWpFtb4z3L/VXL88DdA1njixx7lgOcyobjBzMbP/fFYzb6N7TVgkwhH1dnl5pnQlM7PdVu0ZtmUn8YXeJ+bD/b4R6UtVdH/T2OBEn0H7ff+Q/cegBlmnkgk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kroah.com; spf=pass smtp.mailfrom=kroah.com; dkim=pass (2048-bit key) header.d=kroah.com header.i=@kroah.com header.b=LJ0nanhy; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=GBP9HhoF; arc=none smtp.client-ip=202.12.124.154 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kroah.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kroah.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kroah.com header.i=@kroah.com header.b="LJ0nanhy"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="GBP9HhoF" Received: from phl-compute-02.internal (phl-compute-02.internal [10.202.2.42]) by mailfhigh.stl.internal (Postfix) with ESMTP id 1B6617A017A; Wed, 5 Aug 2026 05:56:42 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-02.internal (MEProxy); Wed, 05 Aug 2026 05:56:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kroah.com; h=cc :cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm3; t=1785923801; x=1786010201; bh=EPzYfu2VEbdpjs22wUAJ45Oz2q2xsxBmXwFNif4jbP8=; b= LJ0nanhy4cl01fU9U4d5YQgcZ+3DaMF8lIaj2wAUgauF1DgYrfaU0XOKkfXRjZps xbk/UX18Kb3YCkHiPXu7HV3xTNKUgbWvsOABeBJP9v/jrJFfT5QTthBrd2WWXhC/ VndTu9ZOKeZS3Q/9yqc4J05WLY9TVdTEO/oi52ItLEJ/aTHSe8bOIg6ddzOVjVvM cGRCWE3mS+5XSRfGlDY+wwVTVSHHUroX5QT3GVv/VWLrd6CO87PyaZW0zMypPlgg 0x52iBG60yKEo01XmBxRaClMuvP0pi8YU49uPGORHckziL2h7zsygUc1qLJy61zh yLdteRKKrSJne2LiQj122g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1785923801; x= 1786010201; bh=EPzYfu2VEbdpjs22wUAJ45Oz2q2xsxBmXwFNif4jbP8=; b=G BP9HhoFiS2wIFiCzILREqU8dYvYkvcQmAXpKK4LGdVCYhLOPb0BkWwzhOegvuTr3 CoOvlI0rsGL+K3Xl2IaUGi5P9BZGcjp4p6llQlAMeX4iqgV/9z1hyCcNtQdjByKI zhJgebNF58zanmJQVg3HRw66ZgvNbe4riww6CQJPLnfZGKvbWysXpsE/ptNCFwvP dEgX0NRPf0pWLemvtU8F6PifaP6czAJ2txdWJoryh5nLDcjZ3CAVU34pAHfsJTPZ bkqrKFeCcUNwusG0GnnanxpsQ7rytDUw6Ooy1YFX6v54CzkX0jd6hpG2qV42Ul5K yOqArDQ8JxRD8cSnqApsQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTErfihmOAQGP1owjinQa15+b58ASSp2+EpXbMDCY18TakmGdDOd7kS8QlWJHK6Akk JmZvI11v1vDpWVeMy6GH/+8SXf4DfFC67MWfsrwTuOZlktEcNWSO67WhyknexN3hurM52E ADVRYD6u8JSJGsN3tC4tRthmsBlaFiKaSBh3tN/tFOt1dPnIBaUdvkvArJT1bKgqhDCslM Zy6lNXyqgUvtM8btJ7En0SOupr11+pqUULhGqHA5Xo7BkWIYuoihnYrmFQrckUAzC8jg0M bT+BTxqemc31+eHPm7BJ8b9lOgPt4Ddk9WdbOw0GYMtz+Xdu83vxH5m557vnBS97gkeCVb tnNJkcEzzjOKJJhH/WyKWBwa+1KROm04wrYvIPWQGsx5SSJABlpJ2jcE/gSt06EYY0kQtj THLZDQBZ3N55cjMxp6rxn9wYVOYbqxyhT9+ZVNnx37yVWpDvE/tD9PJNZxFc1VtFqxfRHE slkHZ4vVpzPFkAHBePmlpexqSl+VXKyvXMHQixR1UzYr5UWFZH0ljasf+FmhI6QGoYCtWg u8tAn5y6sjjFROCuOQ+LJ5Q2Gigrx5W34H6kJaIc/XwnM43zEdJPdQcEV/LRk9OjTQpFqx xhWyFNDrBITrFy22lEv5szUehGQGosuSIhZDX77avSTl3JnmmKqBJyrsIpJw X-ME-Proxy: Feedback-ID: i1d2843be:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 5 Aug 2026 05:56:40 -0400 (EDT) From: Griffin Kroah-Hartman Date: Wed, 05 Aug 2026 11:56:35 +0200 Subject: [PATCH v2 1/3] Input: xpad - add out-of-bounds checks for xpadone Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-xpadone_length_checks-v2-1-f3e925e0280b@kroah.com> References: <20260805-xpadone_length_checks-v2-0-f3e925e0280b@kroah.com> In-Reply-To: <20260805-xpadone_length_checks-v2-0-f3e925e0280b@kroah.com> To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Griffin Kroah-Hartman X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1785923798; l=3959; i=griffin@kroah.com; s=20260706; h=from:subject:message-id; bh=PCULd3aOCMPWlFtJNldzCFrdhWkCSzV7ap70zn+oqvE=; b=hdwHOTuwHLjZeE9ARruDXu9UwnlfRsmZC9R2472d+Fy7jVJtUd8nUnAxQJ7QjIyC2/niec6IY xxovh8JNV/PBV/6AaDPtbx59bhAoQCTVpdhe5cC0K1/X1wQ5dHgBVhV X-Developer-Key: i=griffin@kroah.com; a=ed25519; pk=Hy1TuVHERdQhLAWwjmxLFNtGj7eEEjaZWPXehAlic5M= Add size checks for the "len" variable in xpadone_process_packet(). This prevents out-of-bounds accesses to the "data" buffer, as "len" comes directly from the hardware. Assisted-by: gkh_clanker_t1000 Signed-off-by: Griffin Kroah-Hartman --- drivers/input/joystick/xpad.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c index feb8f368f834..9ce792503b3a 100644 --- a/drivers/input/joystick/xpad.c +++ b/drivers/input/joystick/xpad.c @@ -1035,8 +1035,14 @@ static void xpadone_process_packet(struct usb_xpad *= xpad, u16 cmd, unsigned char struct input_dev *dev =3D xpad->dev; bool do_sync =3D false; =20 + if (len < 2) + return; + len =3D min(len, XPAD_PKT_LEN); + /* the xbox button has its own special report */ if (data[0] =3D=3D GIP_CMD_VIRTUAL_KEY) { + if (len < 5) + return; /* * The Xbox One S controller requires these reports to be * acked otherwise it continues sending them forever and @@ -1052,6 +1058,8 @@ static void xpadone_process_packet(struct usb_xpad *x= pad, u16 cmd, unsigned char } else if (data[0] =3D=3D GIP_CMD_FIRMWARE) { /* Some packet formats force us to use this separate to poll paddle inpu= ts */ if (xpad->packet_type =3D=3D PKT_XBE2_FW_5_11) { + if (len < 20) + return; /* Mute paddles if controller is in a custom profile slot * Checked by looking at the active profile slot to * verify it's the default slot @@ -1079,9 +1087,13 @@ static void xpadone_process_packet(struct usb_xpad *= xpad, u16 cmd, unsigned char error); } } else if (data[0] =3D=3D GIP_CMD_INPUT) { /* The main valid packet type = for inputs */ + if (len < 18) + return; /* menu/view buttons */ input_report_key(dev, BTN_START, data[4] & BIT(2)); input_report_key(dev, BTN_SELECT, data[4] & BIT(3)); + do_sync =3D true; + if (xpad->mapping & MAP_SHARE_BUTTON) { u32 offset =3D (xpad->mapping & MAP_SHARE_OFFSET) ? 26 : 18; =20 @@ -1145,13 +1157,18 @@ static void xpadone_process_packet(struct usb_xpad = *xpad, u16 cmd, unsigned char } =20 /* Profile button has a value of 0-3, so it is reported as an axis */ - if (xpad->mapping & MAP_PROFILE_BUTTON) + if (xpad->mapping & MAP_PROFILE_BUTTON) { + if (len < 35) + goto exit; input_report_abs(dev, ABS_PROFILE, data[34]); + } =20 /* paddle handling */ /* based on SDL's SDL_hidapi_xboxone.c */ if (xpad->mapping & MAP_PADDLES) { if (xpad->packet_type =3D=3D PKT_XBE1) { + if (len < 33) + goto exit; /* Mute paddles if controller has a custom mapping applied. * Checked by comparing the current mapping * config against the factory mapping config @@ -1165,6 +1182,8 @@ static void xpadone_process_packet(struct usb_xpad *x= pad, u16 cmd, unsigned char input_report_key(dev, BTN_GRIPL, data[32] & BIT(0)); input_report_key(dev, BTN_GRIPL2, data[32] & BIT(2)); } else if (xpad->packet_type =3D=3D PKT_XBE2_FW_OLD) { + if (len < 20) + goto exit; /* Mute paddles if controller has a custom mapping applied. * Checked by comparing the current mapping * config against the factory mapping config @@ -1178,6 +1197,8 @@ static void xpadone_process_packet(struct usb_xpad *x= pad, u16 cmd, unsigned char input_report_key(dev, BTN_GRIPL, data[18] & BIT(2)); input_report_key(dev, BTN_GRIPL2, data[18] & BIT(3)); } else if (xpad->packet_type =3D=3D PKT_XBE2_FW_5_EARLY) { + if (len < 24) + goto exit; /* Mute paddles if controller has a custom mapping applied. * Checked by comparing the current mapping * config against the factory mapping config @@ -1197,7 +1218,7 @@ static void xpadone_process_packet(struct usb_xpad *x= pad, u16 cmd, unsigned char =20 do_sync =3D true; } - +exit: if (do_sync) input_sync(dev); } --=20 2.55.0 From nobody Fri Oct 2 04:46:28 2026 Received: from fout-b6-smtp.messagingengine.com (fout-b6-smtp.messagingengine.com [202.12.124.149]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BB21941A4E1; Wed, 5 Aug 2026 09:56:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.149 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785923806; cv=none; b=IiqRwE6lqvOOimG9v0WsoGit8dgJI/Xa2zo+bxWz4wH4DhB9IDir1lAt4L6/W+EflwiEdmE7qyAivL9Ju55dyNp/LxPiojDQ3xRbWqoxLENaYh1P80wvcx/YNs19nIFgJZYASwLZby9+Ks9vx77drBxIiZyMH3Ja4xKnGOQk3fI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785923806; c=relaxed/simple; bh=ysulJ+qIdP9M03dX9q3uuIZsRi1KA0P5wAYKVrFTxkU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=r9ux3AjeWnuKFFZaIusbqhjXpXPXbtOB3/NEQmqAWHSV8GrsjwWVTXMakT37DqNo7e6GG0NyrpwjAX+oJppE+mpVoVZusVJ+mlhLNL6V0PEA46t47jGlFINeNqXOLovXUaf7yPEXFW5QBUc6N2KACF9V80+qSeWS7Ul0PvRn+60= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kroah.com; spf=pass smtp.mailfrom=kroah.com; dkim=pass (2048-bit key) header.d=kroah.com header.i=@kroah.com header.b=lEWTKV4c; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=aQK1Hooq; arc=none smtp.client-ip=202.12.124.149 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kroah.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kroah.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kroah.com header.i=@kroah.com header.b="lEWTKV4c"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="aQK1Hooq" Received: from phl-compute-02.internal (phl-compute-02.internal [10.202.2.42]) by mailfout.stl.internal (Postfix) with ESMTP id BCE031D0011F; Wed, 5 Aug 2026 05:56:43 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-02.internal (MEProxy); Wed, 05 Aug 2026 05:56:43 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kroah.com; h=cc :cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm3; t=1785923803; x=1786010203; bh=fC7lT3XFqTMVz0S9gEzMPr616r+hjTfz37jKvq6p+Zs=; b= lEWTKV4clADGaDUqYEyBURKNkpGKyfsXz2RYiKImgtKADKht5cexo9+qT6mFqQz+ u6GX3U2K0K6XcmojEeLicQ5qfbN3QMLxXMk43tOP9YEJDAaZcU/hWi7SqHaK/O5L OECYYJBCEVsCSDjWGZNq6KakVd6rvR+xIVGvudt3zgi0G8zS60Zq+3niusmnf19a eqZJ1frEpr4RFqCHpBgc2Y3ZjIX6SVXhu/xPpit0fI9YsJ3BgL7y/QC0soG8YU7P GvQodOkr9JFv1fB2DsqcibziPFMSmVRRdiPyP7v1VSGfskmexprfhYBImjkbUBaP b71QLwPoMYRrxp/KY+CpGw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1785923803; x= 1786010203; bh=fC7lT3XFqTMVz0S9gEzMPr616r+hjTfz37jKvq6p+Zs=; b=a QK1HooqnCCwug21fYZ/S+3J4/xsXk8zejDCic7UR7Esz29iHqtA1Zu4TqJKDG6D9 8rJ7qqDL+EkXtCDZQ6zWJpkyz0G89cocnNjxoWvGv21UnLET76JvhmLyXbGTR9ZO Rfazex4zimNW3taiY2nsrwH1HzkOiWgskdxr9nSWXa5u2sAJVs74XWJDE8zN40VB W/1LbOeiBXmvTzTWoeoIfVrCNMbgo0XnM+HWIRANNZSeSix3A351xiQ887mhvq/C SxUtvSAnrNon3oVNg6MZSsnAEdj/g+xrnOqOvns+Buh8AM5RdDltOJ3kYW0lUPmi 9SGjSpVZihgFBqsVbI15A== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGFmieYTi6XVSD9JS6fFv4Co7/tsx/JNRmS47kQ29d8pHJTrqV8y2YYcKvdOSEOsy amltvU1PihpoMPE9lypDUg/6+RcLmLeiRhVhdB2TRj4x7BXBh5Kqp/k0BTuFPaJJ0fGabH Di0slKmG24fGELEppYniAqsRVJURoRRgu2i2BK8GLrYmli4SKxSi3n55E3H/0a5xG+zG1s Lho5fEA7CE0KIIug9ZFYAnjcLRWNtDwaYdrQhrTZVUzMnumGGsz2QIwo6PhT3lSk7UFoc4 O7RUy6ZFvCTjOQaAr24VYGuRnM5Zj4wDzO4ue4+btCjvpfrTYOjaj8Dibz9zfHzSqkJEF1 zxzYjW7lnQC3C8tYsRWj7nQwR7H+vth3qonhl3P2zzqV1aA6r8XX1FWJ3Gl62iITS7QqLR K4wr7LL7RcYMaW7ir0rnH30OM6jV4wquOmbEA/3UnygoV1uAx4oIIV0tC+cJbP0u0XDZcB DqYtKJKtlidGlqeZQtMFINeidZCA5/rxZBf0YxPp3LumPRBvYmLBY3rYIeUZhAF674vhnV fYSujmwpTq/oHgqpcA6zUdNoEBeD9nV+t5Jx58q8GZsRVhj5LF0ixPutpbg2KoOspUuvcm 860rCixJCu51OQHVz8H1eu0pRPXg9Kby45EbAIB5HVDkrfoMKasIYTwysRIA X-ME-Proxy: Feedback-ID: i1d2843be:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 5 Aug 2026 05:56:42 -0400 (EDT) From: Griffin Kroah-Hartman Date: Wed, 05 Aug 2026 11:56:36 +0200 Subject: [PATCH v2 2/3] Input: xpad - add packet length check for xpad_process_packet() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-xpadone_length_checks-v2-2-f3e925e0280b@kroah.com> References: <20260805-xpadone_length_checks-v2-0-f3e925e0280b@kroah.com> In-Reply-To: <20260805-xpadone_length_checks-v2-0-f3e925e0280b@kroah.com> To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Griffin Kroah-Hartman X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1785923798; l=1356; i=griffin@kroah.com; s=20260706; h=from:subject:message-id; bh=ysulJ+qIdP9M03dX9q3uuIZsRi1KA0P5wAYKVrFTxkU=; b=xb0D/E6AM+YrymkHhVmkKTrTzAFLbI2v25TrCC+sM2leFn6yRp4zXFOfOHZ7rZZun0UxFsnXH Ln2m2yetDYOCK1F77MIXnMe2B9Po6E/9/nrXqIGu5AffSBIS0VLq8b9 X-Developer-Key: i=griffin@kroah.com; a=ed25519; pk=Hy1TuVHERdQhLAWwjmxLFNtGj7eEEjaZWPXehAlic5M= Add a check to ensure that the packet being processed is not less than 20 bytes, which would enable an OOB read if true. Signed-off-by: Griffin Kroah-Hartman --- drivers/input/joystick/xpad.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c index 9ce792503b3a..83bc361b15f7 100644 --- a/drivers/input/joystick/xpad.c +++ b/drivers/input/joystick/xpad.c @@ -795,10 +795,13 @@ static void xpad360w_poweroff_controller(struct usb_x= pad *xpad); * The used report descriptor was taken from ITO Takayuki's website: * http://euc.jp/periphs/xbox-controller.ja.html */ -static void xpad_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned c= har *data) +static void xpad_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned c= har *data, u32 len) { struct input_dev *dev =3D xpad->dev; =20 + if (len < 20) + return; + if (!(xpad->mapping & MAP_STICKS_TO_NULL)) { /* left stick */ input_report_abs(dev, ABS_X, @@ -1259,7 +1262,7 @@ static void xpad_irq_in(struct urb *urb) xpadone_process_packet(xpad, 0, xpad->idata, urb->actual_length); break; default: - xpad_process_packet(xpad, 0, xpad->idata); + xpad_process_packet(xpad, 0, xpad->idata, urb->actual_length); } =20 exit: --=20 2.55.0 From nobody Fri Oct 2 04:46:28 2026 Received: from fhigh-b3-smtp.messagingengine.com (fhigh-b3-smtp.messagingengine.com [202.12.124.154]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 56C5B41A516; Wed, 5 Aug 2026 09:56:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.154 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785923807; cv=none; b=QjXqoMkJllMrMF7OAhu5vLyLK+hb1WH1gGML9t6ziy8hevUD6FHK1c9D+S3oy6tlRvdafgNwTb2QWdJRFzMzZsqCcgPanOODYVt68sftdvixIVh8LOz3YLmSLGNTw5QMrB0rOoey79t+hYiow8NcX5vsdpgIgULeS25occNklHY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785923807; c=relaxed/simple; bh=jNdWbaG1JTO4YVucHlz45Nf1w5WMDfgHYsy7ENTovIc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=D9Q8mhRcGfYImwLtL1jpoJ29NA92VZSFIN+59ToQyeMesJ6APq6sxAMYswyrpEoQhs4JjPHcX1XYhQMyXJwp0mZIZ7vIszERmWoXubLE6kiWBaGLP0LIvocR/ZYTZz9EIAdxB1I0z0b8EXR1QMy4bs9Uux8f1LlmmeceuDCuUtc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kroah.com; spf=pass smtp.mailfrom=kroah.com; dkim=pass (2048-bit key) header.d=kroah.com header.i=@kroah.com header.b=QxpGBPP6; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=jbKeg0Z0; arc=none smtp.client-ip=202.12.124.154 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kroah.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kroah.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kroah.com header.i=@kroah.com header.b="QxpGBPP6"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="jbKeg0Z0" Received: from phl-compute-03.internal (phl-compute-03.internal [10.202.2.43]) by mailfhigh.stl.internal (Postfix) with ESMTP id 5AAF37A0160; Wed, 5 Aug 2026 05:56:45 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-03.internal (MEProxy); Wed, 05 Aug 2026 05:56:45 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kroah.com; h=cc :cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm3; t=1785923805; x=1786010205; bh=9H7tqjmM41XGATvnizOzKXIiYIaR1C4nEL91sCrc0JE=; b= QxpGBPP6N4ifhSMb/hCdG3se1V73u4SqBPiTnrmo34TjOvVRpopKjMsYLxMD3+HX hwkdM1yIBxs2un1F55d6WoOsiethNw8cHADbKPxLNCDclXaL79AY7IgCa5gp+2SW UJG6sLDmnw5Inq5t4T4OMgtV92PcpNg0IVgc9ov8jyKhUOunl+iUDgGgaDpyxGVn CE9qWnBmTVU4qwZorvFeXSjFRM/cF7jIZ/jgjjUCtix+aEuVe+PKlshQ+uwO11wa l1jD+3TOrtU/JPHqEMuaM18elDvqNAzIGC2j4Ywe7Jf4N4ivUkJnmEleT/iADwXT PYW4mBsGyAYMk4Em+5hEHA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1785923805; x= 1786010205; bh=9H7tqjmM41XGATvnizOzKXIiYIaR1C4nEL91sCrc0JE=; b=j bKeg0Z0gZsu2f2scOZlyLevjx6JWqa+6lLV9yXZov1MyrgTaKV8PjFZ1ug4rmkA+ 9Ddli3mvQcYdfdW9DgmLGxNlrV4QmFgWOK6GbzAFUqKfn2U2e1c4LUqwxF++EiwA cW9VqD2UhuvBTeAy35/aGg4SbBEDatWhoSl203R6ZHCHQE3NsLVMv9p9J3tHBmUB +EZr8uIreTvpzjYfDSvoEQ1fxI9/GVfAg3zqAp5va+Ku+I8Sdzn2eDOQZQtKnr8u DfnFHGA6iGUrXNH5eA75+viJFkYDwx23yBSLib3fnmvEomvnWhfbkORkEF9JrQ8M cZJZZ1Of//xid5F8rUnJQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTErfihmOAQGP1owjinQa15+b58ASSp2+EpXbMDCY18TakmGdDOd7kS8QlWJHK6Akk JmZvI11v1vDpWVeMy6GH/+8SXf4DfFC67MWfsrwTuOZlktEcNWSO67WhyknexN3hurM52E ADVRYD6u8JSJGsN3tC4tRthmsBlaFiKaSBh3tN/tFOt1dPnIBaUdvkvArJT1bKgqhDCslM Zy6lNXyqgUvtM8btJ7En0SOupr11+pqUULhGqHA5Xo7BkWIYuoihnYrmFQrckUAzC8jg0M bT+BTxqemc31+eHPm7BJ8b9lOgPt4Ddk9WdbOw0GYMtz+Xdu83vxH5m557vnBS97gkeCp0 PesBTdyxrfMiB7S2PN1OYfS84u/qV8e0Cx10cFLrgSj7Ij/VFYkABcB+GeT2KnjR/GhyEs zhjmh6x8eYibI82GQ97wJ19Sc3Z8IJUf+/DD5G2YJ6ZU/B0hfj9zC7PP84F4vB5j1gNCLN Q8/YYP2AsiZHeFKuFFAJ0SShvu7ZbBTbOSdMCNEF2/kDAF+woUSy8QBIWoBKVF7Q+pLkgz ybHaMYSbjmO+bnQd298fUFRQkGcoYUXcWf4vWwlZKrnNHyXUPvYj7VuxusjVRg5WyiPJx+ PL6mps7NRlEYgLj0pQcK/DLdpJHLnqMoYi55cz7X7exZxifJ9Bxx/ZqA3MDw X-ME-Proxy: Feedback-ID: i1d2843be:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 5 Aug 2026 05:56:44 -0400 (EDT) From: Griffin Kroah-Hartman Date: Wed, 05 Aug 2026 11:56:37 +0200 Subject: [PATCH v2 3/3] Input: xpad - add size checks to xpad360 packet processing Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260805-xpadone_length_checks-v2-3-f3e925e0280b@kroah.com> References: <20260805-xpadone_length_checks-v2-0-f3e925e0280b@kroah.com> In-Reply-To: <20260805-xpadone_length_checks-v2-0-f3e925e0280b@kroah.com> To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Griffin Kroah-Hartman X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1785923798; l=2267; i=griffin@kroah.com; s=20260706; h=from:subject:message-id; bh=jNdWbaG1JTO4YVucHlz45Nf1w5WMDfgHYsy7ENTovIc=; b=QCytBoRe3Vtn8W6U5uZXZSgAA28DPBbtFjfL552fXO5n2yBst0E0pJoevzm3PfBHuoRf94NhO w1C7XBmrJKpDukPBPI8OyaQbWvumTEwTlpeqI7LQ4gRE4k0QAxBVZfy X-Developer-Key: i=griffin@kroah.com; a=ed25519; pk=Hy1TuVHERdQhLAWwjmxLFNtGj7eEEjaZWPXehAlic5M= Add size checks to xbox360_process_packet() and xbox360w_process_packet() to prevent OOB reads with the data[] array. Signed-off-by: Griffin Kroah-Hartman --- drivers/input/joystick/xpad.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c index 83bc361b15f7..6f15eafc6477 100644 --- a/drivers/input/joystick/xpad.c +++ b/drivers/input/joystick/xpad.c @@ -870,10 +870,10 @@ static void xpad_process_packet(struct usb_xpad *xpad= , u16 cmd, unsigned char *d */ =20 static void xpad360_process_packet(struct usb_xpad *xpad, struct input_dev= *dev, - u16 cmd, unsigned char *data) + u16 cmd, unsigned char *data, u32 len) { /* valid pad data */ - if (data[0] !=3D 0x00) + if (data[0] !=3D 0x00 || len < 14) return; =20 /* digital pad */ @@ -998,11 +998,14 @@ static void xpad_presence_work(struct work_struct *wo= rk) * 01.1 - Pad state (Bytes 4+) valid * */ -static void xpad360w_process_packet(struct usb_xpad *xpad, u16 cmd, unsign= ed char *data) +static void xpad360w_process_packet(struct usb_xpad *xpad, u16 cmd, unsign= ed char *data, u32 len) { struct input_dev *dev; bool present; =20 + if (len < 2) + return; + /* Presence change */ if (data[0] & 0x08) { present =3D (data[1] & 0x80) !=3D 0; @@ -1019,8 +1022,8 @@ static void xpad360w_process_packet(struct usb_xpad *= xpad, u16 cmd, unsigned cha =20 rcu_read_lock(); dev =3D rcu_dereference(xpad->x360w_dev); - if (dev) - xpad360_process_packet(xpad, dev, cmd, &data[4]); + if (dev && len > 4) + xpad360_process_packet(xpad, dev, cmd, &data[4], len - 4); rcu_read_unlock(); } =20 @@ -1253,10 +1256,10 @@ static void xpad_irq_in(struct urb *urb) =20 switch (xpad->xtype) { case XTYPE_XBOX360: - xpad360_process_packet(xpad, xpad->dev, 0, xpad->idata); + xpad360_process_packet(xpad, xpad->dev, 0, xpad->idata, urb->actual_leng= th); break; case XTYPE_XBOX360W: - xpad360w_process_packet(xpad, 0, xpad->idata); + xpad360w_process_packet(xpad, 0, xpad->idata, urb->actual_length); break; case XTYPE_XBOXONE: xpadone_process_packet(xpad, 0, xpad->idata, urb->actual_length); --=20 2.55.0