[PATCH] HID: playstation: validate num_touch_reports in DualShock 4 reports

[PATCH] HID: playstation: validate num_touch_reports in DualShock 4 reports

[FirstName LastName]

From: Benoît Sevens <bsevens@google.com>

The DualShock 4 HID driver fails to validate the num_touch_reports field
received from the device in both USB and Bluetooth input reports.
A malicious device could set this field to a value larger than the
allocated size of the touch_reports array (3 for USB, 4 for Bluetooth),
leading to an out-of-bounds read in dualshock4_parse_report().

This can result in kernel memory disclosure when processing malicious
HID reports.

Validate num_touch_reports against the array size for the respective
connection types before processing the touch data.

Signed-off-by: Benoît Sevens <bsevens@google.com>
---
 drivers/hid/hid-playstation.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/hid/hid-playstation.c b/drivers/hid/hid-playstation.c
index 3c0db8f93c82..c43caac20b61 100644
--- a/drivers/hid/hid-playstation.c
+++ b/drivers/hid/hid-playstation.c
@@ -2377,6 +2377,12 @@ static int dualshock4_parse_report(struct ps_device *ps_dev, struct hid_report *
 		struct dualshock4_input_report_usb *usb =
 			(struct dualshock4_input_report_usb *)data;
 
+		if (usb->num_touch_reports > ARRAY_SIZE(usb->touch_reports)) {
+			hid_err(hdev, "DualShock4 USB input report has invalid num_touch_reports=%d\n",
+				usb->num_touch_reports);
+			return -EINVAL;
+		}
+
 		ds4_report = &usb->common;
 		num_touch_reports = usb->num_touch_reports;
 		touch_reports = usb->touch_reports;
@@ -2391,6 +2397,12 @@ static int dualshock4_parse_report(struct ps_device *ps_dev, struct hid_report *
 			return -EILSEQ;
 		}
 
+		if (bt->num_touch_reports > ARRAY_SIZE(bt->touch_reports)) {
+			hid_err(hdev, "DualShock4 BT input report has invalid num_touch_reports=%d\n",
+				bt->num_touch_reports);
+			return -EINVAL;
+		}
+
 		ds4_report = &bt->common;
 		num_touch_reports = bt->num_touch_reports;
 		touch_reports = bt->touch_reports;
-- 
2.53.0.959.g497ff81fa9-goog

Re: [PATCH] HID: playstation: validate num_touch_reports in DualShock 4 reports

[Jiri Kosina]

Dear FirstName LastName,

there seems to be a way to fix in your mail setup configuration :)

On Mon, 23 Mar 2026, FirstName LastName wrote:

> From: Beno=C3=AEt Sevens <bsevens@google.com>
> 
> The DualShock 4 HID driver fails to validate the num_touch_reports field
> received from the device in both USB and Bluetooth input reports.
> A malicious device could set this field to a value larger than the
> allocated size of the touch_reports array (3 for USB, 4 for Bluetooth),
> leading to an out-of-bounds read in dualshock4_parse_report().
> 
> This can result in kernel memory disclosure when processing malicious
> HID reports.
> 
> Validate num_touch_reports against the array size for the respective
> connection types before processing the touch data.
> 
> Signed-off-by: Beno=C3=AEt Sevens <bsevens@google.com>

Applied now to hid.git#for-7.0/upstream-fixes, thanks!

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH] HID: playstation: validate num_touch_reports in DualShock 4 reports

[Lee Jones]

Stable Team,

> From: Benoît Sevens <bsevens@google.com>
> 
> The DualShock 4 HID driver fails to validate the num_touch_reports field
> received from the device in both USB and Bluetooth input reports.
> A malicious device could set this field to a value larger than the
> allocated size of the touch_reports array (3 for USB, 4 for Bluetooth),
> leading to an out-of-bounds read in dualshock4_parse_report().
> 
> This can result in kernel memory disclosure when processing malicious
> HID reports.
> 
> Validate num_touch_reports against the array size for the respective
> connection types before processing the touch data.
> 
> Signed-off-by: Benoît Sevens <bsevens@google.com>
> ---
>  drivers/hid/hid-playstation.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)

Could we have this in all branches up to and including linux-6.6.y please?

Upstream commit:

  Fixes: 82a4fc463309 ("HID: playstation: validate num_touch_reports in DualShock 4 reports")

-- 
Lee Jones

Re: [PATCH] HID: playstation: validate num_touch_reports in DualShock 4 reports

[Lee Jones]

[This time with the Stable Team included #fail]

> Stable Team,
> 
> > From: Benoît Sevens <bsevens@google.com>
> > 
> > The DualShock 4 HID driver fails to validate the num_touch_reports field
> > received from the device in both USB and Bluetooth input reports.
> > A malicious device could set this field to a value larger than the
> > allocated size of the touch_reports array (3 for USB, 4 for Bluetooth),
> > leading to an out-of-bounds read in dualshock4_parse_report().
> > 
> > This can result in kernel memory disclosure when processing malicious
> > HID reports.
> > 
> > Validate num_touch_reports against the array size for the respective
> > connection types before processing the touch data.
> > 
> > Signed-off-by: Benoît Sevens <bsevens@google.com>
> > ---
> >  drivers/hid/hid-playstation.c | 12 ++++++++++++
> >  1 file changed, 12 insertions(+)
> 
> Could we have this in all branches up to and including linux-6.6.y please?
> 
> Upstream commit:
> 
>   Fixes: 82a4fc463309 ("HID: playstation: validate num_touch_reports in DualShock 4 reports")

-- 
Lee Jones