Re: [PATCH] Input: touchwin - reset the packet index on every complete packet

Re: [PATCH] Input: touchwin - reset the packet index on every complete packet

[Dmitry Torokhov]

On Sat, Jun 13, 2026 at 08:07:20PM -0500, Bryam Vargas via B4 Relay wrote:
> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> tw_interrupt() accumulates each non-zero serial byte into a fixed
> three-byte buffer with a running index that is only reset once a full
> packet has been received *and* the device's two Y bytes agree:
> 
> 	tw->data[tw->idx++] = data;
> 	if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
> 		...
> 		tw->idx = 0;
> 	}
> 
> The reset is gated on tw->data[1] == tw->data[2], a value the device
> controls.  A malicious, malfunctioning or counterfeit Touchwindow
> peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the
> index reaches TW_LENGTH without the equality holding, is never reset, and
> keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte
> array and the rest of the heap-allocated struct tw, one attacker-chosen
> byte at a time -- an unbounded, device-driven heap out-of-bounds write.
> 
> Reset the index on every completed packet and report an event only when
> the two Y bytes match, like the other serio touchscreen drivers do.
> 
> Fixes: 11ea3173d5f2 ("Input: add driver for Touchwin serial touchscreens")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>

Applied, thank you.

-- 
Dmitry