From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f50.google.com (mail-dl1-f50.google.com [74.125.82.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C47B4393DC8 for ; Tue, 23 Jun 2026 03:54:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782186849; cv=none; b=sEMW6G1GGln70baTIhPhM4hyAm0ghfjxlki07tPGDRQw5/NBAzW/3Wik9bB0BK9fjSaoTcSdhh2TfFInyY9/PJOI+yR27g2dzWwHphqKdA8e7No97hMs8dvqWF/dta6cchUsfrWiKedrboQmYxsB2se+wIeRkPoBtG7hklRqY2M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782186849; c=relaxed/simple; bh=AtobID1XN2SBdN6N7K+JDLiP7Lz92I4F6L3HYo1ow0E=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=jIfFkYOuI7ux+iVstMOw7q/uhzIRG0aFvREDunHhbsBPovB4Tth5FA7GdpL8kiXRRYNgIaQlSJjlBhUVMS7NQMUgLTZnuFkp7zpJQM+t2DTEPKWu8mk4Zu6Cy9jE3JYCb24dvgYIIWmwNES9+xYf7D+L4PB6+lwnXXQS4oR2zpI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=go1Pp/sA; arc=none smtp.client-ip=74.125.82.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="go1Pp/sA" Received: by mail-dl1-f50.google.com with SMTP id a92af1059eb24-13810b63a1aso3217519c88.1 for ; Mon, 22 Jun 2026 20:54:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782186839; x=1782791639; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=0nIWqLfpotqRiv/1wHZwPTTITbqTrkCA4q6I67J/OHE=; b=go1Pp/sAZ/JJmK9N18C69ilBQdIUqjwQ+0VuPnz2PGWW2aw66nwHFuX8rU+a0Pn206 ASaswRJj0WrtFEWIbr9O1dXAlEDhXpoyCfyvTZ9d9xe/QYiE3gP+VZ2HKO2mt8HePL4Z E9pssk0rhSVFPh1dNZfc+nkrmX1qUWpxSvOSu2Y9jB2eolOqep6N4Q5qKe0axDXEs5vu /3BPpivsp+kgfjHaeUyMdgzBdip3yBllsupBIPhHKf9UR3Uo8UzOZPcui222b5NJbDhG /O+2BecbPij2rYXa6Up+7GvtE1IGIspdiNFYGfcvIqf5y+YO6ePGe123n+ZKsQpA7qPs /Xyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782186839; x=1782791639; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=0nIWqLfpotqRiv/1wHZwPTTITbqTrkCA4q6I67J/OHE=; b=QXX0o153AGQVJSiqxKZ0kY1PguZGk/nKLtcFVzBlRoZSYy7sFX/M5YotlbfOaDoGEM z9SQrrgHflMVqO5d86EWva7ZnG4cZXGv+2H/oU4kx/jOtiWOaSosITduBhXo9UQBjQfq OTzdRh9yfifff+Azympi33pIjsdPJEr3G4Hw0Wxi1VVIKfZqVrNmEHPecHTE5u706a8J fysVZJLRWfz751SYRdvEqinOXmxMuLcbQ49NSF+a7PdiGB5iL70iwf9EKrbRgR0kw1L2 e1YRbaHihkHCbnw+9o+CkJmRrK1EqEqtp8svo9qm6WDeeyqfM7D07t/6ZB7UA4hYgE3V 5q1A== X-Forwarded-Encrypted: i=1; AFNElJ+6KGZ9gQjlVEL7w0hjM2bug7fSI26QUV7S+nNOpDUplJ9bbK0hy0uBMCVBRaSlF7cIkIeSxAfW+ccR4vQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxDr21PEeV5oF8r1th7pw7iRG3AgSwjj70FHMQVY3YSG9ZD+MpA 6w7o162+veAvBHgMOjjv8SaTRIgwMVF9RorMS++lfWEIox7u3sMsvVxR X-Gm-Gg: AfdE7ckgv415CzGhtGrytTiIKI5ICxxW/WnQW/VXC9eS9nZte6UzFTC0gFK7M+ms3Xq GhjOUZZGq+1OuLludZJUqAQQpeiMhkIFylghfM6BGx2edABnUQpn+vXl0EoefkLFVNHWoaLixdQ RC1FLTwc1dZwRP3ZuIpgVTI7KSBnHF97icIJ2Y7iqsMzg2xne9LRH9jovzk0LLCVZXWprOL4jRh V9AaMIiRkM/rM5GqcKh+QQGYRLpURmNET1S/jBMm/bd/KrJaV+0LP5k3x2eMM2To9uaYK2ZrLSY EeIAleiYpQNe+orrcp+JAXcPqNTe3i6/L5aTnogFo5yMEWcPu9s6DtCSgi0E9lKU0Rk/UawHtsU 4C667hyZKmUNS7wYdKvXnXu+EMLSfirRWbzE2KRsVotp0fQeBX0M/yuVdZhn1NTS8Tik+tiwI8P igou+MzvrkwKPXK5KjGFkQREp5XDnVjCW2hpkTQQtNlSQfTmzIlpTgQlnDk02DrkGf X-Received: by 2002:a05:7022:7a4:b0:136:5e4c:7aba with SMTP id a92af1059eb24-139ad6ac8ccmr9959250c88.16.1782186839459; Mon, 22 Jun 2026 20:53:59 -0700 (PDT) Received: from google.com ([2a00:79e0:2ebe:8:7d8d:3bdf:d563:1911]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-139add5bd68sm11767253c88.11.2026.06.22.20.53.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Jun 2026 20:53:58 -0700 (PDT) Date: Mon, 22 Jun 2026 20:53:55 -0700 From: Dmitry Torokhov To: hexlabsecurity@proton.me Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] Input: iforce - bound the device-reported force-feedback effect index Message-ID: References: <20260613-b4-disp-4828d263-v1-1-02320e1a89dd@proton.me> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260613-b4-disp-4828d263-v1-1-02320e1a89dd@proton.me> On Sat, Jun 13, 2026 at 09:58:55PM -0500, Bryam Vargas via B4 Relay wrote: > From: Bryam Vargas > > iforce_process_packet() handles a status report (packet id 0x02) by > taking a force-feedback effect index straight from the device wire and > using it to address the per-effect state array: > > i = data[1] & 0x7f; > if (data[1] & 0x80) { > if (!test_and_set_bit(FF_CORE_IS_PLAYED, > iforce->core_effects[i].flags)) > ... > } else if (test_and_clear_bit(FF_CORE_IS_PLAYED, > iforce->core_effects[i].flags)) { > ... > } > > The index is masked only with 0x7f, so it ranges 0..127, but > core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index > of 32..127 the test_and_set_bit()/test_and_clear_bit() is an > out-of-bounds single-bit read-modify-write past the array. core_effects[] > is the second-to-last member of struct iforce, so the write lands in the > trailing members and beyond the embedding kzalloc()'d iforce_serio / > iforce_usb object. > > data[1] is unvalidated device payload on both transports (the USB > interrupt endpoint and serio), and the status path is not gated on force > feedback being present, so a malicious or counterfeit device can set or > clear a bit at an attacker-chosen offset past the object. > > Reject an out-of-range index instead of indexing with it. Bound against > the array dimension IFORCE_EFFECTS_MAX rather than dev->ff->max_effects so > the check guarantees memory safety regardless of how many effects the > device registered. A legitimate "effect started/stopped" status always > carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are > unaffected; the neighbouring mark_core_as_ready() loop is already bounded > and is left untouched. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Cc: stable@vger.kernel.org > Signed-off-by: Bryam Vargas Thank you, applied (but I dropped the temporary 'flags'). -- Dmitry