linux-kernel - Re: [PATCH v2] HID: multitouch: fix slab out-of-bounds access in mt_report

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0541891e-2631-43fa-8f3c-a7afb83436b2@kernel.org>
Date: Thu, 24 Jul 2025 09:01:24 +0200
From: Jiri Slaby <jirislaby@...nel.org>
To: Qasim Ijaz <qasdev00@...il.com>, jikos@...nel.org, bentiss@...nel.org
Cc: envelsavinds@...il.com, linux-input@...r.kernel.org,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v2] HID: multitouch: fix slab out-of-bounds access in
 mt_report_fixup()

On 23. 07. 25, 13:00, Qasim Ijaz wrote:
> A malicious HID device can trigger a slab out-of-bounds during
> mt_report_fixup() by passing in report descriptor smaller than
> 607 bytes. mt_report_fixup() attempts to patch byte offset 607
> of the descriptor with 0x25 by first checking if byte offset
> 607 is 0x15 however it lacks bounds checks to verify if the
> descriptor is big enough before conducting this check. Fix
> this bug by ensuring the descriptor size is at least 608
> bytes before accessing it.
> 
> Below is the KASAN splat after the out of bounds access happens:
> 
> [   13.671954] ==================================================================
> [   13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110
...
> [...]
> 
> Fixes: c8000deb6836 ("HID: multitouch: Add support for GT7868Q")
> Cc: stable@...r.kernel.org
> Signed-off-by: Qasim Ijaz <qasdev00@...il.com>

LGTM
Reviewed-by: Jiri Slaby <jirislaby@...nel.org>

> --- a/drivers/hid/hid-multitouch.c
> +++ b/drivers/hid/hid-multitouch.c
> @@ -1503,6 +1503,14 @@ static const __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc,
>   	if (hdev->vendor == I2C_VENDOR_ID_GOODIX &&
>   	    (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 ||
>   	     hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) {
> +		if (*size < 608) {
> +			dev_info(

Except I would not add \n to the line above.

> +				&hdev->dev,
> +				"GT7868Q fixup: report descriptor is only %u bytes, skipping\n",
> +				*size);
> +			return rdesc;
> +		}
> +
>   		if (rdesc[607] == 0x15) {
>   			rdesc[607] = 0x25;
>   			dev_info(

thanks,
-- 
js
suse labs