[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID:
<VI1PR07MB5821D612EE852EC35C2E095DEDAC2@VI1PR07MB5821.eurprd07.prod.outlook.com>
Date: Tue, 1 Apr 2025 19:06:37 +0000
From: "Gerecke, Jason" <Jason.Gerecke@...om.com>
To: Qasim Ijaz <qasdev00@...il.com>, "Cheng, Ping" <Ping.Cheng@...om.com>,
"jikos@...nel.org" <jikos@...nel.org>, "bentiss@...nel.org"
<bentiss@...nel.org>
CC: "linux-input@...r.kernel.org" <linux-input@...r.kernel.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, syzbot
<syzbot+d5204cbbdd921f1f7cad@...kaller.appspotmail.com>,
"stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: Re: [PATCH] HID: wacom: fix shift OOB in kfifo allocation for zero
pktlen
On Tue, April 1, 2025 at 5:59 AM Qasim Ijaz <qasdev00@...il.com> wrote:
> During wacom_parse_and_register() the code calls wacom_devm_kfifo_alloc
> to allocate a fifo. During this operation it passes kfifo_alloc a
> fifo_size of 0. Kfifo attempts to round the size passed to it to the
> next power of 2 via roundup_pow_of_two (queue-type data structures
> do this to maintain efficiency of operations).
>
> However during this phase a problem arises when the roundup_pow_of_two()
> function utilises a shift exponent of fls_long(n-1), where n is the
> fifo_size. Since n is 0 in this case and n is also an unsigned long,
> doing n-1 causes unsigned integer wrap-around to occur making the
> fifo_size 4294967295. So the code effectively does fls_long(4294967295)
> which results in 64. Returning back to roundup_pow_of_two(), the code
> utilises a shift exponent of 64. When a shift exponent of 64 is used
> on a 64-bit type such as 1UL it results in a shift-out-of-bounds.
>
> The root cause of the issue seems to stem from insufficient validation
> of wacom_compute_pktlen(), since in this case the fifo_size comes
> from wacom_wac->features.pktlen. During wacom_parse_and_register()
> the wacom_compute_pktlen() function sets the pktlen as 0.
>
> To fix this, we should handle cases where wacom_compute_pktlen()
> results in 0.
>
> Reported-by: syzbot <syzbot+d5204cbbdd921f1f7cad@...kaller.appspotmail.com>
> Closes: https://syzkaller.appspot.com/bug?extid=d5204cbbdd921f1f7cad
> Tested-by: Qasim Ijaz <qasdev00@...il.com>
> Cc: stable@...r.kernel.org
> Signed-off-by: Qasim Ijaz <qasdev00@...il.com>
> ---
> drivers/hid/wacom_sys.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
> index 97393a3083ca..9b2f3dbca467 100644
> --- a/drivers/hid/wacom_sys.c
> +++ b/drivers/hid/wacom_sys.c
> @@ -2361,6 +2361,8 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
> unsigned int connect_mask = HID_CONNECT_HIDRAW;
>
> features->pktlen = wacom_compute_pktlen(hdev);
> + if (!features->pktlen)
> + return -ENODEV;
>
> if (!devres_open_group(&hdev->dev, wacom, GFP_KERNEL))
> return -ENOMEM;
> --
> 2.39.5
>
This looks acceptable to me. Taking a closer look at this area, I have a feeling that 'wacom_compute_pktlen' should also consider feature reports in its calculation (so that we allocate enough space for e.g. GET_FEATURE responses). I'll look into this more over the next few days.
Please add the following to the end of the commit description for traceability:
> Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit")
With that modification in place:
Reviewed-by: Jason Gerecke <jason.gerecke@...om.com>
--------
Jason Gerecke (she / they), Senior Linux Software Engineer
Wacom Technology Corporation
tel: 503-525-3100 ext. 3229 (direct)
http://www.wacom.com
Powered by blists - more mailing lists