* Re: [PATCH] HID: playstation: validate num_touch_reports in DualShock 4 reports
[not found] ` <20260713112252.GA3774971@google.com>
@ 2026-07-13 11:24 ` Lee Jones
0 siblings, 0 replies; only message in thread
From: Lee Jones @ 2026-07-13 11:24 UTC (permalink / raw)
To: FirstName LastName, stable
Cc: Roderick Colenbrander, Jiri Kosina, Benjamin Tissoires,
linux-input, linux-kernel
[This time with the Stable Team included #fail]
> Stable Team,
>
> > From: Benoît Sevens <bsevens@google.com>
> >
> > The DualShock 4 HID driver fails to validate the num_touch_reports field
> > received from the device in both USB and Bluetooth input reports.
> > A malicious device could set this field to a value larger than the
> > allocated size of the touch_reports array (3 for USB, 4 for Bluetooth),
> > leading to an out-of-bounds read in dualshock4_parse_report().
> >
> > This can result in kernel memory disclosure when processing malicious
> > HID reports.
> >
> > Validate num_touch_reports against the array size for the respective
> > connection types before processing the touch data.
> >
> > Signed-off-by: Benoît Sevens <bsevens@google.com>
> > ---
> > drivers/hid/hid-playstation.c | 12 ++++++++++++
> > 1 file changed, 12 insertions(+)
>
> Could we have this in all branches up to and including linux-6.6.y please?
>
> Upstream commit:
>
> Fixes: 82a4fc463309 ("HID: playstation: validate num_touch_reports in DualShock 4 reports")
--
Lee Jones
^ permalink raw reply [flat|nested] only message in thread