linux-kernel - [PATCH 2/2] Input: adp5588-keys Prevent buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250516134313.282564-3-arefev@swemel.ru>
Date: Fri, 16 May 2025 16:43:04 +0300
From: Denis Arefev <arefev@...mel.ru>
To: Michael Hennerich <michael.hennerich@...log.com>
Cc: Nuno Sá <noname.nuno@...il.com>,
	Dmitry Torokhov <dmitry.torokhov@...il.com>,
	linux-input@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org
Subject: [PATCH 2/2] Input: adp5588-keys Prevent buffer overflow

If the value of 'key_val' is less than 1 or greater than 80,
a buffer overflow may occur.

Add a check for valid values 'key_val'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Denis Arefev <arefev@...mel.ru>
---
 drivers/input/keyboard/adp5588-keys.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/input/keyboard/adp5588-keys.c b/drivers/input/keyboard/adp5588-keys.c
index 13136f863270..91f00d6e2413 100644
--- a/drivers/input/keyboard/adp5588-keys.c
+++ b/drivers/input/keyboard/adp5588-keys.c
@@ -164,6 +164,9 @@
 #define KEY_EV_PRESSED		BIT(7)
 #define KEY_EV_MASK		GENMASK(6, 0)
 
+#define KEY_EVENT_MIN		1
+#define KEY_EVENT_MAX		80
+
 #define KP_SEL(x)		(BIT(x) - 1)	/* 2^x-1 */
 
 #define KEYP_MAX_EVENT		10
@@ -531,7 +534,7 @@ static void adp5588_report_events(struct adp5588_kpad *kpad, int ev_cnt)
 		if (key_val >= GPI_PIN_BASE && key_val <= GPI_PIN_END) {
 			/* gpio line used as IRQ source */
 			adp5588_gpio_irq_handle(kpad, key_val, key_press);
-		} else {
+		} else if (key_val >= KEY_EVENT_MIN && key_val <= KEY_EVENT_MAX) {
 			int row = (key_val - 1) / ADP5588_COLS_MAX;
 			int col =  (key_val - 1) % ADP5588_COLS_MAX;
 			int code = MATRIX_SCAN_CODE(row, col, kpad->row_shift);
@@ -542,6 +545,8 @@ static void adp5588_report_events(struct adp5588_kpad *kpad, int ev_cnt)
 
 			input_report_key(kpad->input,
 					 kpad->keycode[code], key_press);
+		} else {
+			dev_err_ratelimited(&kpad->client->dev, "invalid report key value %d", key);
 		}
 	}
 }
-- 
2.43.0