github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Input: ims-pcu - add response length checks

Browse Source 
The driver processes response data from device buffers without verifying
that the device actually sent enough data. This can lead to
out-of-bounds reads or processing stale data.

Add checks for the expected response length before accessing the
buffers.

Fixes: 628329d524 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
Dmitry Torokhov 2026-05-22 10:40:54 -07:00
parent 8adf4289d9
commit 48c9d92fd4
1 changed files with 81 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
drivers/input/misc/ims-pcu.c
View File

@ -407,7 +407,16 @@ static void ims_pcu_destroy_gamepad(struct ims_pcu *pcu)
static void ims_pcu_report_events(struct ims_pcu *pcu)
{
u32 data = get_unaligned_be32(&pcu->read_buf[3]);
u32 data;
/* 6-axis setting (1 byte) + button data + checksum */
if (pcu->read_pos < IMS_PCU_DATA_OFFSET + 1 + sizeof(data) + 1) {
dev_warn(pcu->dev, "Short buttons report: %d bytes\n",
pcu->read_pos);
return;
}
data = get_unaligned_be32(&pcu->read_buf[IMS_PCU_DATA_OFFSET + 1]);
ims_pcu_buttons_report(pcu, data & ~IMS_PCU_GAMEPAD_MASK);
if (pcu->gamepad)
@ -687,11 +696,19 @@ static int __ims_pcu_execute_bl_command(struct ims_pcu *pcu,
return error;
}
if (expected_response && pcu->cmd_buf[2] != expected_response) {
dev_err(pcu->dev,
"Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n",
pcu->cmd_buf[2], expected_response);
return -EINVAL;
if (expected_response) {
if (pcu->cmd_buf_len < 3) {
dev_err(pcu->dev, "Short response from bootloader: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
if (pcu->cmd_buf[2] != expected_response) {
dev_err(pcu->dev,
"Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n",
pcu->cmd_buf[2], expected_response);
return -EINVAL;
}
}
return 0;
@ -719,6 +736,12 @@ static int ims_pcu_get_info(struct ims_pcu *pcu)
return error;
}
if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + IMS_PCU_SET_INFO_SIZE + 1) {
dev_err(pcu->dev, "Short GET_INFO response: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
memcpy(pcu->part_number,
&pcu->cmd_buf[IMS_PCU_INFO_PART_OFFSET],
sizeof(pcu->part_number));
@ -816,6 +839,12 @@ static int ims_pcu_verify_block(struct ims_pcu *pcu,
return error;
}
if (pcu->cmd_buf_len < IMS_PCU_BL_DATA_OFFSET + sizeof(*fragment) + len + 1) {
dev_err(pcu->dev, "Short READ_APP response: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
fragment = (void *)&pcu->cmd_buf[IMS_PCU_BL_DATA_OFFSET];
if (get_unaligned_le32(&fragment->addr) != addr ||
fragment->len != len) {
@ -1009,6 +1038,10 @@ ims_pcu_backlight_get_brightness(struct led_classdev *cdev)
error);
/* Assume the LED is OFF */
brightness = LED_OFF;
} else if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 2 + 1) {
dev_err(pcu->dev, "Short GET_BRIGHTNESS response: %d bytes\n",
pcu->cmd_buf_len);
brightness = LED_OFF;
} else {
brightness =
get_unaligned_le16(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
@ -1287,6 +1320,12 @@ static int ims_pcu_read_ofn_config(struct ims_pcu *pcu, u8 addr, u8 *data)
if (error)
return error;
if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) {
dev_err(pcu->dev, "Short OFN_GET_CONFIG response: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET);
if (result < 0)
return -EIO;
@ -1307,6 +1346,12 @@ static int ims_pcu_write_ofn_config(struct ims_pcu *pcu, u8 addr, u8 data)
if (error)
return error;
if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) {
dev_err(pcu->dev, "Short OFN_SET_CONFIG response: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET);
if (result < 0)
return -EIO;
@ -1850,6 +1895,12 @@ static int ims_pcu_get_device_info(struct ims_pcu *pcu)
return error;
}
if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) {
dev_err(pcu->dev, "Short GET_FW_VERSION response: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
snprintf(pcu->fw_version, sizeof(pcu->fw_version),
"%02d%02d%02d%02d.%c%c",
pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
@ -1862,6 +1913,12 @@ static int ims_pcu_get_device_info(struct ims_pcu *pcu)
return error;
}
if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) {
dev_err(pcu->dev, "Short GET_BL_VERSION response: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
snprintf(pcu->bl_version, sizeof(pcu->bl_version),
"%02d%02d%02d%02d.%c%c",
pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
@ -1874,6 +1931,12 @@ static int ims_pcu_get_device_info(struct ims_pcu *pcu)
return error;
}
if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) {
dev_err(pcu->dev, "Short RESET_REASON response: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
snprintf(pcu->reset_reason, sizeof(pcu->reset_reason),
"%02x", pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
@ -1900,6 +1963,12 @@ static int ims_pcu_identify_type(struct ims_pcu *pcu, u8 *device_id)
return error;
}
if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) {
dev_err(pcu->dev, "Short GET_DEVICE_ID response: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
*device_id = pcu->cmd_buf[IMS_PCU_DATA_OFFSET];
dev_dbg(pcu->dev, "Detected device ID: %d\n", *device_id);
@ -1991,6 +2060,12 @@ static int ims_pcu_init_bootloader_mode(struct ims_pcu *pcu)
return error;
}
if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 15 + 4 + 1) {
dev_err(pcu->dev, "Short QUERY_DEVICE response: %d bytes\n",
pcu->cmd_buf_len);
return -EIO;
}
pcu->fw_start_addr =
get_unaligned_le32(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET + 11]);
pcu->fw_end_addr =