kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/input/touchscreen
History
Bryam Vargas 39b12daf1a Input: mms114 - reject an oversized device packet size 
[ Upstream commit 66725039f7 ]

mms114_interrupt() reads a packet of touch data from the device into a
fixed-size on-stack buffer

	struct mms114_touch touch[MMS114_MAX_TOUCH];

which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,
i.e. 80 bytes. The length of the I2C read into it is taken verbatim from
the device:

	packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE);
	if (packet_size <= 0)
		goto out;
	...
	error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,
			(u8 *)touch);

packet_size is a single device register byte (0x0F) and the only check
is the lower bound packet_size <= 0; it is never bounded against the
size of touch[]. A malfunctioning, malicious or counterfeit controller
(or an attacker tampering with the I2C bus) can report a packet_size of
up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of
touch[] on the IRQ-thread stack: a stack out-of-bounds write that can
overwrite the stack canary, saved registers and the return address.

A well-formed device never reports more than the buffer holds, so reject
an oversized packet and drop the report, consistent with the handler's
other error paths, rather than reading past the buffer.

Fixes: 07b8481d4a ("Input: add MELFAS mms114 touchscreen driver")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260612-b4-disp-dc4b8dc4-v1-1-d7cb0a828d92@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ changed `&client->dev` to `&data->client->dev` since 6.1's interrupt handler lacks the `client` local variable ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-23 14:17:18 +02:00
..
88pm860x-ts.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
ad7877.c Input: ad7877 - use new structure for SPI transfer delays 2020-12-10 23:39:15 -08:00
ad7879-i2c.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
ad7879-spi.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
ad7879.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
ad7879.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
ads7846.c Input: ads7846 - ratelimit the spi_sync error message 2024-10-17 15:10:32 +02:00
ar1021_i2c.c Input: move to use request_irq by IRQF_NO_AUTOEN flag 2021-03-25 15:27:56 -07:00
atmel_mxt_ts.c Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem 2026-06-19 13:33:29 +02:00
auo-pixcir-ts.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
bcm_iproc_tsc.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
bu21013_ts.c Input: bu21013_ts - switch to using standard touchscreen properties 2019-09-02 09:07:38 -07:00
bu21029_ts.c Input: move to use request_irq by IRQF_NO_AUTOEN flag 2021-03-25 15:27:56 -07:00
chipone_icn8318.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
chipone_icn8505.c Input: icn8505 - Switch to firmware_request_platform for retreiving the fw 2020-03-20 14:57:54 +01:00
colibri-vf50-ts.c Input: colibri-vf50-ts - remove unneeded gpio.h header file 2019-10-27 11:14:22 -07:00
cy8ctma140.c Input: add driver for the Cypress CY8CTMA140 touchscreen 2020-05-09 22:26:48 -07:00
cy8ctmg110_ts.c Input: cy8ctmg110_ts - switch to using gpiod API 2021-06-05 20:34:16 -07:00
cyttsp4_core.c minmax: don't use max() in situations that want a C constant expression 2025-10-19 16:21:52 +02:00
cyttsp4_core.h Input: cyttsp4 - move 'cyttsp4_tch_abs_string' to the only file that references it 2020-11-08 22:35:48 -08:00
cyttsp4_i2c.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
cyttsp4_spi.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
cyttsp_core.c Input: cyttsp - remove public header 2021-06-01 21:13:11 -07:00
cyttsp_core.h Input: cyttsp - remove public header 2021-06-01 21:13:11 -07:00
cyttsp_i2c.c Input: cyttsp - remove public header 2021-06-01 21:13:11 -07:00
cyttsp_i2c_common.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
cyttsp_spi.c Input: cyttsp - remove public header 2021-06-01 21:13:11 -07:00
da9034-ts.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
da9052_tsi.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
dynapro.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
edt-ft5x06.c Input: edt-ft5x06 - added case for EDT EP0110M09 2021-09-05 19:10:11 -07:00
eeti_ts.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
egalax_ts.c Input: egalax_ts - add system wakeup support 2018-09-18 15:28:07 -07:00
egalax_ts_serial.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
ektf2127.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
elants_i2c.c Input: elants_i2c - properly handle the reset GPIO when power is off 2022-12-31 13:14:10 +01:00
elo.c Input: elo - fix an error code in elo_connect() 2021-02-18 14:39:42 -08:00
exc3000.c Input: exc3000 - fix return value check of wait_for_completion_timeout 2022-08-25 11:40:08 +02:00
fsl-imx25-tcq.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
fujitsu_ts.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
goodix.c Input: goodix - clamp the device-reported contact count 2026-07-24 15:51:26 +02:00
goodix.h Input: goodix - try not to touch the reset-pin on x86/ACPI devices 2022-07-12 16:34:51 +02:00
gunze.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
hampshire.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
hideep.c Input: hideep - fix the uninitialized use in hideep_nvm_unlock() 2021-06-19 22:36:28 -07:00
hp680_ts_input.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
htcpen.c isa: Make the remove callback for isa drivers return void 2021-01-26 07:42:27 +01:00
hycon-hy46xx.c Input: add driver for the Hycon HY46XX touchpanel series 2021-04-13 19:08:30 -07:00
ili210x.c Input: ili210x - fix ili251x_read_touch_data() return value 2024-07-05 09:14:39 +02:00
ilitek_ts_i2c.c Input: ilitek_ts_i2c - add report id message validation 2024-10-17 15:11:00 +02:00
imx6ul_tsc.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
inexio.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
ipaq-micro-ts.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
iqs5xx.c Input: iqs5xx - make reset GPIO optional 2021-03-25 11:14:10 -07:00
jornada720_ts.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
Kconfig Input: Fix spelling mistake in Kconfig "Modul" -> "Module" 2021-09-03 23:49:55 -07:00
lpc32xx_ts.c Input: lpc32xx_ts - convert to use BIT() 2021-03-20 19:48:37 -07:00
mainstone-wm97xx.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
Makefile Input: add driver for the Hycon HY46XX touchpanel series 2021-04-13 19:08:30 -07:00
max11801_ts.c Input: Use fallthrough pseudo-keyword 2020-07-07 11:25:54 -07:00
mc13783_ts.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
mcs5000_ts.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
melfas_mip4.c Input: melfas_mip4 - fix return value check in mip4_probe() 2022-10-05 10:39:42 +02:00
migor_ts.c Input: migor_ts - convert to SPDX identifiers 2018-11-12 11:52:05 -08:00
mk712.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
mms114.c Input: mms114 - reject an oversized device packet size 2026-08-23 14:17:18 +02:00
msg2638.c Input: add MStar MSG2638 touchscreen driver 2021-04-09 23:22:38 -07:00
mtouch.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
mxs-lradc-ts.c Input: mxs-lradc-ts - use devm_platform_ioremap_resource() 2019-07-24 12:48:47 +03:00
pcap_ts.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
penmount.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
pixcir_i2c_ts.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
raspberrypi-ts.c Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe 2023-05-11 23:00:36 +09:00
raydium_i2c_ts.c Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() 2022-12-08 11:28:45 +01:00
resistive-adc-touch.c Input: resistive-adc-touch - fix division by zero error on z1 == 0 2021-10-15 22:11:03 -07:00
rohm_bu21023.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282 2019-06-05 17:36:37 +02:00
s3c2410_ts.c ARM: s3c: adc: move header to linux/soc/samsung 2020-08-19 21:44:11 +02:00
s6sy761.c Input: s6sy761 - fix coordinate read bit shift 2021-03-07 15:14:25 -08:00
silead.c Input: silead - Always support 10 fingers 2024-07-27 10:46:08 +02:00
sis_i2c.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282 2019-06-05 17:36:37 +02:00
st1232.c Input: st1232 - increase "wait ready" timeout 2021-11-18 19:17:01 +01:00
stmfts.c Input: stmfts - do not leave device disabled in stmfts_input_open 2022-06-09 10:23:13 +02:00
stmpe-ts.c Input: stmpe-ts - add description for 'prop' struct member 2021-01-19 19:03:18 -08:00
sun4i-ts.c Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register 2020-01-10 14:42:52 -08:00
sur40.c Input: sur40 - fix V4L error path cleanup 2026-08-23 14:17:16 +02:00
surface3_spi.c Input: surface3_spi - remove set but unused variable 'timestamp' 2021-01-19 19:03:16 -08:00
sx8654.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
ti_am335x_tsc.c Input: ti_am335x_tsc - fix off-by-one error in wire_order validation 2026-01-19 13:09:45 +01:00
touchit213.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
touchright.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
touchwin.c Input: touchwin - reset the packet index on every complete packet 2026-07-24 15:51:26 +02:00
tps6507x-ts.c Input: tsc6507x-ts - switch to using polled mode of input devices 2019-10-29 17:13:41 -07:00
ts4800-ts.c Input: ts4800-ts - switch to using polled mode of input devices 2019-10-29 17:13:40 -07:00
tsc40.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 315 2019-06-05 17:37:05 +02:00
tsc200x-core.c Input: tsc200x-core - use kobj_to_dev() 2021-06-19 22:36:23 -07:00
tsc200x-core.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tsc2004.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tsc2005.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tsc2007.h Input: tsc2007 - convert to GPIO descriptors 2021-03-15 17:12:02 -07:00
tsc2007_core.c Input: tsc2007 - make use of device properties 2021-03-15 17:12:04 -07:00
tsc2007_iio.c iio: remove explicit IIO device parent assignment 2020-06-14 11:49:59 +01:00
ucb1400_ts.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
usbtouchscreen.c Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size 2026-06-19 13:33:22 +02:00
wacom_i2c.c Input: wacom_i2c - switch to using managed resources 2021-03-25 11:14:09 -07:00
wacom_w8001.c Input: wacom_w8001 - allocate additional space for 'phys' 2019-08-20 12:03:46 -07:00
wdt87xx_i2c.c Input: wdt87xx_i2c - replace mdelay() with msleep() in wdt87xx_resume() 2018-07-27 11:59:05 -07:00
wm97xx-core.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
wm831x-ts.c Input: move to use request_irq by IRQF_NO_AUTOEN flag 2021-03-25 15:27:56 -07:00
wm9705.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
wm9712.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
wm9713.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
zet6223.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
zforce_ts.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
zinitix.c Input: zinitix - do not report shadow fingers 2022-04-08 14:22:47 +02:00
zylonite-wm97xx.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00