[PATCH v1 1/1] Input: ALPS - bail out when device path can't fit buffer
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: 2025-04-22 18:56:56
Also in:
lkml
Subsystem:
alps ps/2 touchpad driver, input (keyboard, mouse, joystick, touchscreen) drivers, the rest · Maintainers:
Dmitry Torokhov, Linus Torvalds
When creating a physical device name in the driver the snprintf() takes
an up to 32 characters argument along with the additional 8 characters
and tries to pack this into 32 bytes array. GCC complains about that
when build with `make W=1`:
drivers/input/mouse/alps.c:1411:9: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
1411 | snprintf(priv->phys3, sizeof(priv->phys3), "%s/%s",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1412 | psmouse->ps2dev.serio->phys,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1413 | (priv->dev2 ? "input2" : "input1"));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/input/mouse/alps.c:3106:17: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
3106 | snprintf(priv->phys2, sizeof(priv->phys2), "%s/input1",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3107 | psmouse->ps2dev.serio->phys);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fix these by checking for the potential overflow.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
drivers/input/mouse/alps.c | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 0bd7b09b0aa3..e76dcb19fa72 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c@@ -1401,6 +1401,16 @@ static int alps_do_register_bare_ps2_mouse(struct alps_data *priv) struct psmouse *psmouse = priv->psmouse; struct input_dev *dev3; int error; + int n; + + n = snprintf(priv->phys3, sizeof(priv->phys3), "%s/%s", + psmouse->ps2dev.serio->phys, + priv->dev2 ? "input2" : "input1"); + if (n >= sizeof(priv->phys3)) { + psmouse_err(psmouse, + "failed to prepare path to the secondary device\n"); + return -E2BIG; + } dev3 = input_allocate_device(); if (!dev3) {
@@ -1408,9 +1418,6 @@ static int alps_do_register_bare_ps2_mouse(struct alps_data *priv) return -ENOMEM; } - snprintf(priv->phys3, sizeof(priv->phys3), "%s/%s", - psmouse->ps2dev.serio->phys, - (priv->dev2 ? "input2" : "input1")); dev3->phys = priv->phys3; /*
@@ -3094,6 +3101,16 @@ int alps_init(struct psmouse *psmouse) if (priv->flags & ALPS_DUALPOINT) { struct input_dev *dev2; + int n; + + n = snprintf(priv->phys2, sizeof(priv->phys2), "%s/input1", + psmouse->ps2dev.serio->phys); + if (n >= sizeof(priv->phys2)) { + psmouse_err(psmouse, + "failed to prepare path to the trackstick device\n"); + error = -E2BIG; + goto init_fail; + } dev2 = input_allocate_device(); if (!dev2) {
@@ -3103,8 +3120,6 @@ int alps_init(struct psmouse *psmouse) goto init_fail; } - snprintf(priv->phys2, sizeof(priv->phys2), "%s/input1", - psmouse->ps2dev.serio->phys); dev2->phys = priv->phys2; /*
--
2.47.2