* [PATCH] Input: iforce - validate packet lengths
@ 2026-07-06 9:20 Pengpeng Hou
2026-07-07 2:56 ` Dmitry Torokhov
0 siblings, 1 reply; 2+ messages in thread
From: Pengpeng Hou @ 2026-07-06 9:20 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: Pengpeng Hou, Bryam Vargas, linux-input, linux-kernel
iforce_process_packet() decodes several packet formats from a
variable-length input buffer.
Add minimum length checks for joystick, wheel and status packets before
reading their fixed fields.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
drivers/input/joystick/iforce/iforce-packets.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/input/joystick/iforce/iforce-packets.c b/drivers/input/joystick/iforce/iforce-packets.c
index effa76bfd8f9..54697b252b84 100644
--- a/drivers/input/joystick/iforce/iforce-packets.c
+++ b/drivers/input/joystick/iforce/iforce-packets.c
@@ -155,6 +155,9 @@ void iforce_process_packet(struct iforce *iforce,
switch (packet_id) {
case 0x01: /* joystick position data */
+ if (len < 5)
+ break;
+
input_report_abs(dev, ABS_X,
(__s16) get_unaligned_le16(data));
input_report_abs(dev, ABS_Y,
@@ -170,6 +173,9 @@ void iforce_process_packet(struct iforce *iforce,
break;
case 0x03: /* wheel position data */
+ if (len < 4)
+ break;
+
input_report_abs(dev, ABS_WHEEL,
(__s16) get_unaligned_le16(data));
input_report_abs(dev, ABS_GAS, 255 - data[2]);
@@ -181,6 +187,9 @@ void iforce_process_packet(struct iforce *iforce,
break;
case 0x02: /* status report */
+ if (len < 2)
+ break;
+
input_report_key(dev, BTN_DEAD, data[0] & 0x02);
input_sync(dev);
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] Input: iforce - validate packet lengths
2026-07-06 9:20 [PATCH] Input: iforce - validate packet lengths Pengpeng Hou
@ 2026-07-07 2:56 ` Dmitry Torokhov
0 siblings, 0 replies; 2+ messages in thread
From: Dmitry Torokhov @ 2026-07-07 2:56 UTC (permalink / raw)
To: Pengpeng Hou; +Cc: Bryam Vargas, linux-input, linux-kernel
Hi Pengpeng,
On Mon, Jul 06, 2026 at 05:20:16PM +0800, Pengpeng Hou wrote:
> iforce_process_packet() decodes several packet formats from a
> variable-length input buffer.
>
> Add minimum length checks for joystick, wheel and status packets before
> reading their fixed fields.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/input/joystick/iforce/iforce-packets.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/drivers/input/joystick/iforce/iforce-packets.c b/drivers/input/joystick/iforce/iforce-packets.c
> index effa76bfd8f9..54697b252b84 100644
> --- a/drivers/input/joystick/iforce/iforce-packets.c
> +++ b/drivers/input/joystick/iforce/iforce-packets.c
> @@ -155,6 +155,9 @@ void iforce_process_packet(struct iforce *iforce,
> switch (packet_id) {
>
> case 0x01: /* joystick position data */
> + if (len < 5)
> + break;
This is not enough. iforce_report_hats_buttons() is called
unconditionally and is referencing data[6].
If we add checks we need to cover all cases.
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-07 2:56 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-06 9:20 [PATCH] Input: iforce - validate packet lengths Pengpeng Hou
2026-07-07 2:56 ` Dmitry Torokhov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox