Re: [PATCH] Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

[Richard Davies <richard@arachsys.com>]

Richard Davies wrote:
>Make finger2 (and also finger1) unsigned, so that if the finger index in
>the packet is 0 then subtracting 1 creates an array index which overflows
>above the existing check for FOC_MAX_FINGERS, as the existing comment says
>it should, instead of writing to state->fingers[-1].

Some further context for my patch...

I get errors such as the following on my laptop running Ubuntu 26.04 LTS:

[   52.422376] ------------[ cut here ]------------
[   52.422381] UBSAN: array-index-out-of-bounds in /build/linux-IJm0IA/linux-7.0.0/drivers/input/mouse/focaltech.c:221:17
[   52.422386] index -1 is out of range for type 'focaltech_finger_state [5]'
[   52.422389] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Tainted: G S                  7.0.0-27-generic #27-Ubuntu PREEMPT(lazy) 
[   52.422392] Tainted: [S]=CPU_OUT_OF_SPEC
[   52.422393] Hardware name: ASUSTeK COMPUTER INC. N550JK/N550JK, BIOS N550JK.208 09/26/2014
[   52.422395] Call Trace:
[   52.422396]  <IRQ>
[   52.422399]  show_stack+0x49/0x60
[   52.422405]  dump_stack_lvl+0x5f/0x90
[   52.422409]  dump_stack+0x10/0x18
[   52.422410]  ubsan_epilogue+0x9/0x39
[   52.422416]  __ubsan_handle_out_of_bounds.cold+0x50/0x55
[   52.422421]  focaltech_process_packet+0x541/0x560 [psmouse]
[   52.422435]  focaltech_process_byte+0x23/0x30 [psmouse]
[   52.422443]  psmouse_handle_byte+0x19/0x70 [psmouse]
[   52.422450]  psmouse_receive_byte+0x8d/0x300 [psmouse]
[   52.422456]  ps2_interrupt+0xa1/0x110
[   52.422462]  serio_interrupt+0x4b/0xb0
[   52.422464]  i8042_handle_data+0x189/0x370
[   52.422466]  ? timekeeping_adjust+0x1e/0x180
[   52.422469]  ? __note_gp_changes+0x1f3/0x270
[   52.422473]  ? sched_balance_domains+0xd9/0x380
[   52.422475]  i8042_interrupt+0x15/0x60
[   52.422478]  __handle_irq_event_percpu+0x59/0x230
[   52.422481]  handle_irq_event+0x36/0x90
[   52.422484]  handle_edge_irq+0xd3/0x1a0
[   52.422487]  __common_interrupt+0x50/0x160
[   52.422489]  ? irq_enter_rcu+0x75/0x90
[   52.422492]  common_interrupt+0xb0/0xe0
[   52.422495]  </IRQ>
[   52.422496]  <TASK>
[   52.422497]  asm_common_interrupt+0x27/0x40
[   52.422499] RIP: 0010:cpuidle_enter_state+0xca/0x700
[   52.422502] Code: 00 e8 ca 91 dd fe e8 15 ee ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 06 7f db fe 80 7d d0 00 0f 85 c6 01 00 00 fb 0f 1f 44 00 00 <45> 85 e4 0f 88 3e 02 00 00 4d 63 fc 49 83 ff 0a 0f 83 1d 05 00 00
[   52.422503] RSP: 0018:ffffd20bc00f3e00 EFLAGS: 00000246
[   52.422505] RAX: 0000000000000000 RBX: ffff8ef0a6dbd6c0 RCX: 0000000000000000
[   52.422507] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   52.422507] RBP: ffffd20bc00f3e50 R08: 0000000000000000 R09: 0000000000000000
[   52.422508] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000005
[   52.422509] R13: 0000000c349ddabc R14: ffffffffb1d54c40 R15: 0000000000000005
[   52.422511]  ? tick_nohz_stop_tick+0x5e/0x260
[   52.422516]  cpuidle_enter+0x30/0x50
[   52.422520]  call_cpuidle+0x21/0x50
[   52.422523]  cpuidle_idle_call+0x16b/0x1f0
[   52.422526]  do_idle+0x94/0xf0
[   52.422528]  cpu_startup_entry+0x29/0x30
[   52.422529]  start_secondary+0x125/0x180
[   52.422532]  ? soft_restart_cpu+0x14/0x14
[   52.422534]  common_startup_64+0x13e/0x141
[   52.422537]  </TASK>
[   52.422537] ---[ end trace ]---

These no longer occur when this patch is applied.

I found similar reports from other users at
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2125250

I found a related review comment when this code was first written at
https://lore.kernel.org/linux-input/20141111171554.GB27720@dtor-ws/

>Fixes: 05be1d079ec0 ("Input: psmouse - support for the FocalTech PS/2 protocol extensions")
>Signed-off-by: Richard Davies <richard@arachsys.com>
>---
> drivers/input/mouse/focaltech.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/input/mouse/focaltech.c b/drivers/input/mouse/focaltech.c
>index 43f9939b7c63..d3ad4af5aa09 100644
>--- a/drivers/input/mouse/focaltech.c
>+++ b/drivers/input/mouse/focaltech.c
>@@ -197,7 +197,7 @@ static void focaltech_process_rel_packet(struct psmouse *psmouse,
> {
> 	struct focaltech_data *priv = psmouse->private;
> 	struct focaltech_hw_state *state = &priv->state;
>-	int finger1, finger2;
>+	unsigned int finger1, finger2;
>
> 	state->pressed = packet[0] >> 7;
> 	finger1 = ((packet[0] >> 4) & 0x7) - 1;
>-- 
>2.53.0