mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [PATCH] HID: pidff: validate effect type usage indexes
@ 2026-11-02 11:58 Yifan Zhang
  2026-11-02 11:58 ` Yifan Zhang
  2026-11-03  9:23 ` Tomasz Pakuła
  0 siblings, 2 replies; 3+ messages in thread
From: Yifan Zhang @ 2026-11-02 11:58 UTC (permalink / raw)
  To: Tomasz Pakuła, Oleg Makarenko, Jiri Kosina,
	Benjamin Tissoires, linux-input
  Cc: Dmitry Torokhov, Anssi Hannula, linux-usb, linux-kernel

pidff_find_special_keys() records usage positions as one-based values, but
pidff_find_effects() uses those values directly as array indexes.  The
Create New Effect and Set Effect fields are independently allocated and
need not have the same number of usages, so a malformed descriptor can
make the lookup leave the Set Effect usage array.

KASAN reports:

  BUG: KASAN: slab-out-of-bounds in hid_pidff_init_with_quirks
  Read of size 4
  hid_pidff_init_with_quirks
  universal_pidff_probe
  hid_device_probe
  uhid_device_add_worker

Convert the stored position back to a zero-based index and validate it
against both fields before comparing the usages.

The reproducer is rejected without a KASAN report with this change.

Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices")
Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
---
 drivers/hid/usbhid/hid-pidff.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
index 22951b7ecd174..5e4a937237d55 100644
--- a/drivers/hid/usbhid/hid-pidff.c
+++ b/drivers/hid/usbhid/hid-pidff.c
@@ -1373,9 +1373,16 @@ static int pidff_find_effects(struct pidff_device *pidff,
 
 	for (i = 0; i < ARRAY_SIZE(pidff_effect_types); i++) {
 		int pidff_type = pidff->type_id[i];
+		int usage_index;
 
-		if (pidff->set_effect_type->usage[pidff_type].hid !=
-		    pidff->create_new_effect_type->usage[pidff_type].hid) {
+		if (!pidff_type)
+			continue;
+
+		usage_index = pidff_type - 1;
+		if (usage_index >= pidff->set_effect_type->maxusage ||
+		    usage_index >= pidff->create_new_effect_type->maxusage ||
+		    pidff->set_effect_type->usage[usage_index].hid !=
+		    pidff->create_new_effect_type->usage[usage_index].hid) {
 			hid_err(pidff->hid,
 				"effect type number %d is invalid\n", i);
 			return -1;
-- 
2.39.5 (Apple Git-154)

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-11-03  9:23 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-02 11:58 [PATCH] HID: pidff: validate effect type usage indexes Yifan Zhang
2026-11-02 11:58 ` Yifan Zhang
2026-11-03  9:23 ` Tomasz Pakuła

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®