Re: [PATCH] Input: iforce - validate packet lengths

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

Hi Pengpeng,

On Mon, Jul 06, 2026 at 05:20:16PM +0800, Pengpeng Hou wrote:
> iforce_process_packet() decodes several packet formats from a
> variable-length input buffer.
> 
> Add minimum length checks for joystick, wheel and status packets before
> reading their fixed fields.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/input/joystick/iforce/iforce-packets.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/input/joystick/iforce/iforce-packets.c b/drivers/input/joystick/iforce/iforce-packets.c
> index effa76bfd8f9..54697b252b84 100644
> --- a/drivers/input/joystick/iforce/iforce-packets.c
> +++ b/drivers/input/joystick/iforce/iforce-packets.c
> @@ -155,6 +155,9 @@ void iforce_process_packet(struct iforce *iforce,
>  	switch (packet_id) {
>  
>  	case 0x01:	/* joystick position data */
> +		if (len < 5)
> +			break;

This is not enough. iforce_report_hats_buttons() is called
unconditionally and is referencing data[6].

If we add checks we need to cover all cases.

Thanks.

-- 
Dmitry