[PATCH v2] HID: wacom: fix shift OOB in kfifo allocation for zero pktlen

[PATCH v2] HID: wacom: fix shift OOB in kfifo allocation for zero pktlen

[Qasim Ijaz]

During wacom_parse_and_register() the code calls wacom_devm_kfifo_alloc 
to allocate a fifo. During this operation it passes kfifo_alloc a 
fifo_size of 0. Kfifo attempts to round the size passed to it to the 
next power of 2 via roundup_pow_of_two (queue-type data structures
do this to maintain efficiency of operations). 

However during this phase a problem arises when the roundup_pow_of_two() 
function utilises a shift exponent of fls_long(n-1), where n is the 
fifo_size. Since n is 0 in this case and n is also an unsigned long, 
doing n-1 causes unsigned integer wrap-around to occur making the 
fifo_size 4294967295. So the code effectively does fls_long(4294967295) 
which results in 64. Returning back to roundup_pow_of_two(), the code 
utilises a shift exponent of 64. When a shift exponent of 64 is used 
on a 64-bit type such as 1UL it results in a shift-out-of-bounds.

The root cause of the issue seems to stem from insufficient validation 
of wacom_compute_pktlen(), since in this case the fifo_size comes 
from wacom_wac->features.pktlen. During wacom_parse_and_register() 
the wacom_compute_pktlen() function sets the pktlen as 0.

To fix this, we should handle cases where wacom_compute_pktlen() 
results in 0.

Reported-by: syzbot <syzbot+d5204cbbdd921f1f7cad@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=d5204cbbdd921f1f7cad
Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit")
Tested-by: Qasim Ijaz <qasdev00@gmail.com>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
---
v2:
- Added Fixes tag as suggested by Jason Gerecke

 drivers/hid/wacom_sys.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 97393a3083ca..9b2f3dbca467 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2361,6 +2361,8 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 	unsigned int connect_mask = HID_CONNECT_HIDRAW;
 
 	features->pktlen = wacom_compute_pktlen(hdev);
+	if (!features->pktlen)
+		return -ENODEV;
 
 	if (!devres_open_group(&hdev->dev, wacom, GFP_KERNEL))
 		return -ENOMEM;
-- 
2.39.5

Re: [PATCH v2] HID: wacom: fix shift OOB in kfifo allocation for zero pktlen

[Markus Elfring]

…
> To fix this, we should handle cases where wacom_compute_pktlen()
> results in 0.

See also once more:
https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.14#n94

Regards,
Markus

Re: [PATCH v2] HID: wacom: fix shift OOB in kfifo allocation for zero pktlen

[Greg KH]

On Wed, Apr 02, 2025 at 10:03:25AM +0200, Markus Elfring wrote:
> …
> > To fix this, we should handle cases where wacom_compute_pktlen()
> > results in 0.
> 
> See also once more:
> https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.14#n94
> 
> Regards,
> Markus
> 

Hi,

This is the semi-friendly patch-bot of Greg Kroah-Hartman.

Markus, you seem to have sent a nonsensical or otherwise pointless
review comment to a patch submission on a Linux kernel developer mailing
list.  I strongly suggest that you not do this anymore.  Please do not
bother developers who are actively working to produce patches and
features with comments that, in the end, are a waste of time.

Patch submitter, please ignore Markus's suggestion; you do not need to
follow it at all.  The person/bot/AI that sent it is being ignored by
almost all Linux kernel maintainers for having a persistent pattern of
behavior of producing distracting and pointless commentary, and
inability to adapt to feedback.  Please feel free to also ignore emails
from them.

thanks,

greg k-h's patch email bot