linux-kernel - [PATCH v1 1/1] Input: ALPS - bail out when device path can't fit buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250422185645.1949391-1-andriy.shevchenko@linux.intel.com>
Date: Tue, 22 Apr 2025 21:56:45 +0300
From: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To: Dmitry Torokhov <dmitry.torokhov@...il.com>,
	linux-input@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Pali Rohár <pali@...nel.org>,
	Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Subject: [PATCH v1 1/1] Input: ALPS - bail out when device path can't fit buffer

When creating a physical device name in the driver the snprintf() takes
an up to 32 characters argument along with the additional 8 characters
and tries to pack this into 32 bytes array. GCC complains about that
when build with `make W=1`:

drivers/input/mouse/alps.c:1411:9: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
 1411 |         snprintf(priv->phys3, sizeof(priv->phys3), "%s/%s",
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1412 |                  psmouse->ps2dev.serio->phys,
      |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1413 |                  (priv->dev2 ? "input2" : "input1"));
      |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

drivers/input/mouse/alps.c:3106:17: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
 3106 |                 snprintf(priv->phys2, sizeof(priv->phys2), "%s/input1",
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 3107 |                          psmouse->ps2dev.serio->phys);
      |                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix these by checking for the potential overflow.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
---
 drivers/input/mouse/alps.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 0bd7b09b0aa3..e76dcb19fa72 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1401,6 +1401,16 @@ static int alps_do_register_bare_ps2_mouse(struct alps_data *priv)
 	struct psmouse *psmouse = priv->psmouse;
 	struct input_dev *dev3;
 	int error;
+	int n;
+
+	n = snprintf(priv->phys3, sizeof(priv->phys3), "%s/%s",
+		     psmouse->ps2dev.serio->phys,
+		     priv->dev2 ? "input2" : "input1");
+	if (n >= sizeof(priv->phys3)) {
+		psmouse_err(psmouse,
+			    "failed to prepare path to the secondary device\n");
+		return -E2BIG;
+	}
 
 	dev3 = input_allocate_device();
 	if (!dev3) {
@@ -1408,9 +1418,6 @@ static int alps_do_register_bare_ps2_mouse(struct alps_data *priv)
 		return -ENOMEM;
 	}
 
-	snprintf(priv->phys3, sizeof(priv->phys3), "%s/%s",
-		 psmouse->ps2dev.serio->phys,
-		 (priv->dev2 ? "input2" : "input1"));
 	dev3->phys = priv->phys3;
 
 	/*
@@ -3094,6 +3101,16 @@ int alps_init(struct psmouse *psmouse)
 
 	if (priv->flags & ALPS_DUALPOINT) {
 		struct input_dev *dev2;
+		int n;
+
+		n = snprintf(priv->phys2, sizeof(priv->phys2), "%s/input1",
+			     psmouse->ps2dev.serio->phys);
+		if (n >= sizeof(priv->phys2)) {
+			psmouse_err(psmouse,
+				    "failed to prepare path to the trackstick device\n");
+			error = -E2BIG;
+			goto init_fail;
+		}
 
 		dev2 = input_allocate_device();
 		if (!dev2) {
@@ -3103,8 +3120,6 @@ int alps_init(struct psmouse *psmouse)
 			goto init_fail;
 		}
 
-		snprintf(priv->phys2, sizeof(priv->phys2), "%s/input1",
-			 psmouse->ps2dev.serio->phys);
 		dev2->phys = priv->phys2;
 
 		/*
-- 
2.47.2