kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Greg Kroah-Hartman e7cdcb266b Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size 
commit 2905281cbd upstream.

nexio_read_data() pulls data_len and x_len from a packed __be16 header
in the device's interrupt packet and then walks packet->data[0..x_len)
and packet->data[x_len..data_len) comparing each byte against a
threshold.

Both fields are 16-bit on the wire (max 65535).  The existing
adjustments shave at most 0x100 / 0x80 off, so the loop bound can still
reach roughly 0xfeff.  The URB transfer buffer for NEXIO is rept_size
(1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the
packed header — so packet->data[] has 1017 valid bytes.  read_data()
callbacks are not given urb->actual_length, and nothing else bounds the
walk.

A device that lies about its length can get a ~64 KiB out-of-bounds read
past the coherent DMA allocation.  The first index whose byte exceeds
NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the
reported touch coordinates, so adjacent kernel memory contents leak to
userspace as ABS_X / ABS_Y events.  Far enough out, the read can also
hit an unmapped page and fault.

Fix this all by clamping data_len to the buffer's data[] capacity and
x_len to data_len.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Fixes: 5197424cdc ("Input: usbtouchscreen - add NEXIO (or iNexio) support")
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026042026-chlorine-epidermis-fd6d@gregkh
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-19 13:33:22 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:39:11 +02:00
acpi ACPI: video: force native backlight on HP OMEN 16 (8A44) 2026-06-01 17:35:19 +02:00
amba amba: tegra-ahb: Fix device leak on SMMU enable 2026-01-19 13:09:54 +01:00
android binder: don't use %pK through printk 2026-03-04 07:20:16 -05:00
ata ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 2026-06-01 17:35:01 +02:00
atm atm: fore200e: fix use-after-free in tasklets during device removal 2026-03-04 07:20:36 -05:00
auxdisplay auxdisplay: arm-charlcd: fix release_mem_region() size 2026-03-04 07:19:20 -05:00
base devres: fix missing node debug info in devm_krealloc() 2026-06-01 17:35:27 +02:00
bcma Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
block drbd: Balance RCU calls in drbd_adm_dump_devices() 2026-06-01 17:35:27 +02:00
bluetooth Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths 2026-06-01 17:35:46 +02:00
bus fsl-mc: Use driver_set_override() instead of open-coding 2026-06-01 17:35:05 +02:00
cdrom cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() 2026-06-01 17:35:41 +02:00
char ipmi:ssif: NULL thread on error 2026-06-01 17:35:20 +02:00
clk clk: qcom: dispcc-sc7180: Add missing MDSS resets 2026-06-01 17:35:37 +02:00
clocksource clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF 2026-03-04 07:20:00 -05:00
comedi comedi: me4000: Fix potential overrun of firmware buffer 2026-04-18 10:33:34 +02:00
connector net/connector: Add const qualifier to cb_id 2020-12-16 11:06:49 -08:00
counter counter: interrupt-cnt: Drop IRQF_NO_THREAD flag 2026-01-19 13:10:18 +01:00
cpufreq cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path 2026-06-01 17:35:11 +02:00
cpuidle cpuidle: powerpc: avoid double clear when breaking snooze 2026-06-01 17:35:22 +02:00
crypto crypto: ccp - copy IV using skcipher ivsize 2026-06-01 17:35:37 +02:00
cxl cxl/mem: Fix shutdown order 2023-11-20 11:08:27 +01:00
dax dax/kmem: Pass valid argument to memory_group_register_static 2023-07-23 13:47:17 +02:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() 2025-08-28 16:24:17 +02:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:14:27 +01:00
dma dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() 2026-06-01 17:35:34 +02:00
dma-buf dma-buf: insert memory barrier before updating num_fences 2025-09-09 18:50:23 +02:00
edac EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() 2026-03-04 07:19:27 -05:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: ptn5150: handle pending IRQ events during system resume 2026-06-01 17:35:22 +02:00
firewire firewire: nosy: Fix dma_free_coherent() size 2026-01-19 13:09:57 +01:00
firmware firmware: arm_ffa: Skip free_pages on RX buffer alloc failure 2026-06-01 17:35:49 +02:00
fpga fpga: dfl: use subsys_initcall to allow built-in drivers to be added 2026-03-04 07:20:25 -05:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-19 12:22:46 +02:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpio: cdev: check if uAPI v2 config attributes are correctly zeroed 2026-06-01 17:35:51 +02:00
gpu drm/msm/snapshot: fix dumping of the unaligned regions 2026-06-01 17:35:50 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:14:23 +02:00
hid HID: quirks: really enable the intended work around for appledisplay 2026-06-01 17:35:50 +02:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-05-02 07:44:06 +02:00
hv Drivers: hv: vmbus: Add utility function for querying ring size 2025-07-10 15:57:36 +02:00
hwmon hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors 2026-06-01 17:35:49 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-12 11:07:41 +02:00
hwtracing coresight: etm3x: Fix cpulocked warning on cpuhp 2026-03-04 07:19:46 -05:00
i2c i2c: s3c24xx: check the size of the SMBUS message before using it 2026-06-01 17:35:04 +02:00
i3c i3c: mipi-i3c-hci: fix IBI payload length calculation for final status 2026-06-01 17:35:35 +02:00
idle intel_idle: Allow loading ACPI tables for any family 2025-08-28 16:24:16 +02:00
iio iio: adc: ad7768-1: fix one-shot mode data acquisition 2026-06-01 17:35:15 +02:00
infiniband RDMA/rtrs: Fix use-after-free in path file creation cleanup 2026-06-01 17:35:51 +02:00
input Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size 2026-06-19 13:33:22 +02:00
interconnect interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node 2025-08-28 16:24:03 +02:00
iommu iommu/vt-d: Disable DMAR for Intel Q35 IGFX 2026-06-01 17:35:45 +02:00
ipack ipack: ipoctal: fix module reference leak 2021-09-27 17:38:49 +02:00
irqchip irqchip/ath79-cpu: Remove unused function 2026-06-01 17:35:50 +02:00
isdn mISDN: annotate data-race around dev->work 2026-02-06 16:41:55 +01:00
leds leds: lgm-sso: Remove duplicate assignments for priv->mmap 2026-06-01 17:35:35 +02:00
macintosh macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse 2026-01-19 13:09:28 +01:00
mailbox mailbox: mailbox-test: make data_ready a per-instance variable 2026-06-01 17:35:41 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:44:31 +02:00
md dm init: ensure device probing has finished in dm-mod.waitfor= 2026-06-01 17:35:30 +02:00
media media: i2c: imx412: Assert reset GPIO during probe 2026-06-01 17:35:25 +02:00
memory memory: tegra30-emc: Fix dll_change check 2026-06-01 17:35:33 +02:00
memstick memstick: Add timeout to prevent indefinite waiting 2025-12-07 06:09:16 +09:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:51:02 +01:00
mfd mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() 2026-06-01 17:35:36 +02:00
misc ibmasm: fix heap over-read in ibmasm_send_i2o_message() 2026-06-01 17:35:13 +02:00
mmc mmc: block: use single block write in retry 2026-06-01 17:35:16 +02:00
most most: usb: fix double free on late probe failure 2025-12-07 06:09:35 +09:00
mtd mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob 2026-06-01 17:35:35 +02:00
mux mux: gpio: Simplify code by using dev_err_probe() 2021-04-02 16:28:53 +02:00
net net: mana: validate rx_req_idx to prevent out-of-bounds array access 2026-06-01 17:35:51 +02:00
nfc NFC: trf7970a: Ignore antenna noise when checking for RF field 2026-06-01 17:35:42 +02:00
ntb NTB: ntb_transport: Fix too small buffer for debugfs_name 2026-03-04 07:20:37 -05:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:25:05 +01:00
nvdimm nvdimm/bus: Fix potential use after free in asynchronous initialization 2026-04-18 10:33:17 +02:00
nvme nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free 2026-06-01 17:35:23 +02:00
nvmem nvmem: core: improve range check for nvmem_cell_write() 2025-03-13 12:50:32 +01:00
of device property: Make modifications of fwnode "flags" thread safe 2026-06-01 17:35:13 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:23 -04:00
parisc parisc: Fix IRQ leak in LASI driver 2026-06-01 17:35:21 +02:00
parport parport_pc: add support for ASIX AX99100 2025-03-13 12:50:46 +01:00
pci PCI: tegra194: Disable direct speed change for Endpoint mode 2026-06-01 17:35:32 +02:00
pcmcia PCMCIA: Fix garbled log messages for KERN_CONT 2026-06-01 17:35:37 +02:00
perf perf: arm_spe: Prevent overflow in PERF_IDX2OFF() 2025-10-19 16:21:29 +02:00
phy phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access 2026-06-01 17:35:50 +02:00
pinctrl pinctrl: abx500: Fix type of 'argument' variable 2026-06-01 17:35:35 +02:00
platform platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL 2026-06-01 17:35:51 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:54:38 +01:00
power power: supply: max17042: avoid overflow when determining health 2026-06-01 17:35:23 +02:00
powercap powercap: fix sscanf() error return value handling 2026-01-19 13:10:19 +01:00
pps pps: fix warning in pps_register_cdev when register device fail 2025-10-19 16:21:33 +02:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. 2026-02-06 16:41:51 +01:00
pwm pwm: stm32: Always program polarity 2026-01-19 13:10:12 +01:00
rapidio rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() 2026-03-04 07:20:32 -05:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-07 11:52:26 +02:00
regulator regulator: bd9571mwv: fix OF node reference imbalance 2026-06-01 17:35:25 +02:00
remoteproc remoteproc: mediatek: Unprepare SCP clock during system suspend 2026-04-18 10:33:11 +02:00
reset reset: brcmstb: Enable reset drivers for ARCH_BCM2835 2025-08-28 16:24:18 +02:00
rpmsg rpmsg: core: fix race in driver_override_show() and use core helper 2026-03-04 07:20:25 -05:00
rtc rtc: abx80x: Disable alarm feature if no interrupt attached 2026-06-01 17:35:40 +02:00
s390 Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" 2026-06-01 17:35:46 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: isci: Fix use-after-free in device removal path 2026-06-01 17:35:47 +02:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2025-01-09 13:28:34 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-26 09:24:36 +01:00
slimbus slimbus: core: fix device reference leak on report present 2026-02-06 16:41:57 +01:00
soc soc: qcom: aoss: compare against normalized cooling state 2026-06-01 17:35:34 +02:00
soundwire soundwire: stream: restore params when prepare ports fail 2025-08-28 16:24:10 +02:00
spi spi: ti-qspi: fix use-after-free after DMA setup failure 2026-06-01 17:35:47 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-07-05 09:14:20 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-09-04 13:23:20 +02:00
staging staging: media: atomisp: Disallow all private IOCTLs 2026-06-01 17:35:24 +02:00
target scsi: target: core: Fix integer overflow in UNMAP bounds check 2026-06-01 17:35:36 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: allow a driver to allocate a tee_device without a pool 2025-12-07 06:09:17 +09:00
thermal thermal/drivers/spear: Fix error condition for reading st,thermal-flags 2026-06-01 17:35:27 +02:00
thunderbolt thunderbolt: Fix property read in nhi_wake_supported() 2026-04-18 10:33:34 +02:00
tty tty: hvc_iucv: fix off-by-one in number of supported devices 2026-06-01 17:35:36 +02:00
uio uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe 2026-01-19 13:09:23 +01:00
usb usb: ulpi: fix memory leak on ulpi_register() error paths 2026-06-01 17:35:20 +02:00
vdpa vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check 2026-06-01 17:35:11 +02:00
vfio vfio/type1: Fix error unwind in migration dirty bitmap allocation 2025-06-27 11:05:13 +01:00
vhost vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() 2026-06-01 17:35:40 +02:00
video fbdev: offb: fix PCI device reference leak on probe failure 2026-06-01 17:35:40 +02:00
virt minmax: add in_range() macro 2025-10-19 16:21:28 +02:00
virtio mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() 2026-01-19 13:10:10 +01:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-06-04 15:27:26 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
vme vme: Fix error not catched in fake_init() 2022-12-31 13:14:30 +01:00
w1 w1: therm: Fix off-by-one buffer overflow in alarms_store 2026-02-06 16:42:02 +01:00
watchdog fix it87_wdt early reboot by reporting running timer 2026-03-04 07:20:16 -05:00
xen xen/privcmd: fix double free via VMA splitting 2026-04-30 11:24:38 +02:00
zorro zorro: Drop useless (and hardly used) .driver member in struct zorro_dev 2021-08-05 14:37:04 +02:00
Kconfig firmware: include drivers/firmware/Kconfig unconditionally 2021-10-07 16:51:26 +02:00
Makefile virtio: always enter drivers/virtio/ 2021-12-22 09:32:39 +01:00