From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E01021E9B1A; Thu, 20 Aug 2026 17:36:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787247388; cv=none; b=gN4lV0uOlzkbada2QrX6DnxrsVTSjeNrYEv9wx2KAmxGnzDZfMLnmjtIDWMO9l0YU8B9KCrqd3uT0HOrVYVpL7ELnsM2Paznbg8lEpC2Z2azSNM+p9llb0Kl5ARcNrsxO1UzvmjQ89T/zeoxlL/zZeg9CJfj+TbjWoJY1ObotB8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787247388; c=relaxed/simple; bh=sdazXp6tdDIWkn+VYqwU3tx/n7uShTLdgdBpLbMkcfs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aR+92I2vUkRXRObxLOgf6VVTUiIICSs1J1zM0hvC6eo3zxvBsOsus5VlEkl3X3SD6E+zfQd21QBS/9DDouqILUcUATfgpOPXCFNUu8vqK7BKIbz4rJZ7Fvi+WWdV7FqEcQ9QTcMb1ZsYSTnC/gGUzRI3ohh/Sok/2YO4GbYSMNo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AMmyna2m; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="AMmyna2m" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0ECED1F00A3A; Thu, 20 Aug 2026 17:36:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787247383; bh=3s0/IBwm7/vzpYJxiEo+ACflUsqYQY42jOj9jt8X5I8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AMmyna2mkJ/10o9aHw89cdBZgbnVfxnTI74Yq0j7OhD53kUkHqHS4mDW05gYGvc1t CQV1xQd8UZzd4BRwTm21zySy+3beFvdIf9UjO5To7EWMs6IO+fYwf9JkWjtB76hc69 yc9Xs0m0EueAsOiKSy6milHOYeiulz9z5oqS/d8w= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Pengpeng Hou , Dmitry Torokhov Subject: [PATCH 6.6 027/166] Input: iforce - validate input packet lengths Date: Thu, 20 Aug 2026 16:54:46 +0200 Message-ID: <20260820145212.002487764@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260820145211.194104353@linuxfoundation.org> References: <20260820145211.194104353@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pengpeng Hou commit 5751c781d3c97ab6ce0e2a966156ed882152c415 upstream. iforce_process_packet() reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally reads data[6]. The status tail is a sequence of 16-bit effect addresses, but an incomplete final address is also consumed. A successful zero-length USB URB additionally reads the packet ID before the common parser is called. Reject the zero-length USB transfer, require the seven-byte joystick and wheel prefixes and the two-byte status prefix, and consume only complete status-tail addresses. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260720115018.75045-1-pengpeng@iscas.ac.cn Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman --- drivers/input/joystick/iforce/iforce-packets.c | 11 ++++++++++- drivers/input/joystick/iforce/iforce-usb.c | 3 +++ 2 files changed, 13 insertions(+), 1 deletion(-) --- a/drivers/input/joystick/iforce/iforce-packets.c +++ b/drivers/input/joystick/iforce/iforce-packets.c @@ -161,6 +161,9 @@ void iforce_process_packet(struct iforce switch (packet_id) { case 0x01: /* joystick position data */ + if (len < 7) + break; + input_report_abs(dev, ABS_X, (__s16) get_unaligned_le16(data)); input_report_abs(dev, ABS_Y, @@ -176,6 +179,9 @@ void iforce_process_packet(struct iforce break; case 0x03: /* wheel position data */ + if (len < 7) + break; + input_report_abs(dev, ABS_WHEEL, (__s16) get_unaligned_le16(data)); input_report_abs(dev, ABS_GAS, 255 - data[2]); @@ -187,6 +193,9 @@ void iforce_process_packet(struct iforce break; case 0x02: /* status report */ + if (len < 2) + break; + input_report_key(dev, BTN_DEAD, data[0] & 0x02); input_sync(dev); @@ -206,7 +215,7 @@ void iforce_process_packet(struct iforce } } - for (j = 3; j < len; j += 2) + for (j = 3; j + sizeof(u16) <= len; j += sizeof(u16)) mark_core_as_ready(iforce, get_unaligned_le16(data + j)); break; --- a/drivers/input/joystick/iforce/iforce-usb.c +++ b/drivers/input/joystick/iforce/iforce-usb.c @@ -159,6 +159,9 @@ static void iforce_usb_irq(struct urb *u goto exit; } + if (!urb->actual_length) + goto exit; + iforce_process_packet(iforce, iforce_usb->data_in[0], iforce_usb->data_in + 1, urb->actual_length - 1);