linux-kernel - Re: [PATCH v2 RESEND] HID: wacom: fix shift OOB in kfifo allocation for zero pktlen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1qq0nspp-174r-58o0-q94n-n3p252s3600n@xreary.bet>
Date: Thu, 24 Apr 2025 12:13:57 +0200 (CEST)
From: Jiri Kosina <jikos@...nel.org>
To: Qasim Ijaz <qasdev00@...il.com>
cc: ping.cheng@...om.com, jason.gerecke@...om.com, bentiss@...nel.org, 
    linux-input@...r.kernel.org, linux-kernel@...r.kernel.org, 
    syzbot <syzbot+d5204cbbdd921f1f7cad@...kaller.appspotmail.com>, 
    stable@...r.kernel.org
Subject: Re: [PATCH v2 RESEND] HID: wacom: fix shift OOB in kfifo allocation
 for zero pktlen

On Mon, 14 Apr 2025, Qasim Ijaz wrote:

> During wacom_parse_and_register() the code calls wacom_devm_kfifo_alloc
> to allocate a fifo. During this operation it passes kfifo_alloc a
> fifo_size of 0. Kfifo attempts to round the size passed to it to the
> next power of 2 via roundup_pow_of_two (queue-type data structures
> do this to maintain efficiency of operations).
> 
> However during this phase a problem arises when the roundup_pow_of_two()
> function utilises a shift exponent of fls_long(n-1), where n is the
> fifo_size. Since n is 0 in this case and n is also an unsigned long,
> doing n-1 causes unsigned integer wrap-around to occur making the
> fifo_size 4294967295. So the code effectively does fls_long(4294967295)
> which results in 64. Returning back to roundup_pow_of_two(), the code
> utilises a shift exponent of 64. When a shift exponent of 64 is used
> on a 64-bit type such as 1UL it results in a shift-out-of-bounds.
> 
> The root cause of the issue seems to stem from insufficient validation
> of wacom_compute_pktlen(), since in this case the fifo_size comes
> from wacom_wac->features.pktlen. During wacom_parse_and_register()
> the wacom_compute_pktlen() function sets the pktlen as 0.
> 
> To fix this, we should handle cases where wacom_compute_pktlen()
> results in 0.
> 
> Reported-by: syzbot <syzbot+d5204cbbdd921f1f7cad@...kaller.appspotmail.com>
> Closes: https://syzkaller.appspot.com/bug?extid=d5204cbbdd921f1f7cad
> Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit")
> Tested-by: Qasim Ijaz <qasdev00@...il.com>
> Reviewed-by: Jason Gerecke <jason.gerecke@...om.com>
> Cc: stable@...r.kernel.org
> Signed-off-by: Qasim Ijaz <qasdev00@...il.com>

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs