Re: [PATCH] Input: iforce - validate packet lengths
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: 2026-07-07 02:56:25
Also in:
lkml
Hi Pengpeng, On Mon, Jul 06, 2026 at 05:20:16PM +0800, Pengpeng Hou wrote:
quoted hunk ↗ jump to hunk
iforce_process_packet() decodes several packet formats from a variable-length input buffer. Add minimum length checks for joystick, wheel and status packets before reading their fixed fields. Signed-off-by: Pengpeng Hou <redacted> --- drivers/input/joystick/iforce/iforce-packets.c | 9 +++++++++ 1 file changed, 9 insertions(+)diff --git a/drivers/input/joystick/iforce/iforce-packets.c b/drivers/input/joystick/iforce/iforce-packets.c index effa76bfd8f9..54697b252b84 100644 --- a/drivers/input/joystick/iforce/iforce-packets.c +++ b/drivers/input/joystick/iforce/iforce-packets.c@@ -155,6 +155,9 @@ void iforce_process_packet(struct iforce *iforce, switch (packet_id) { case 0x01: /* joystick position data */ + if (len < 5) + break;
This is not enough. iforce_report_hats_buttons() is called unconditionally and is referencing data[6]. If we add checks we need to cover all cases. Thanks. -- Dmitry