[PATCH] Input: usbtouchscreen - validate Nexio reply length
From: Pengpeng Hou <hidden>
Date: 2026-06-30 06:53:59
Also in:
lkml
Subsystem:
input (keyboard, mouse, joystick, touchscreen) drivers, the rest · Maintainers:
Dmitry Torokhov, Linus Torvalds
nexio_init() accepts replies with actual_len == 1 and then reads buf[1] to compare the embedded length. Require at least two bytes before checking the embedded reply length. Signed-off-by: Pengpeng Hou <redacted> --- drivers/input/touchscreen/usbtouchscreen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 0bbacb5..0e07bcc 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c@@ -1011,7 +1011,7 @@ static int nexio_init(struct usbtouch_usb *usbtouch) ret = usb_bulk_msg(dev, usb_rcvbulkpipe(dev, input_ep), buf, NEXIO_BUFSIZE, &actual_len, NEXIO_TIMEOUT); - if (ret < 0 || actual_len < 1 || buf[1] != actual_len) + if (ret < 0 || actual_len < 2 || buf[1] != actual_len) continue; switch (buf[0]) { case 0x83: /* firmware version */