| Message ID | 20250401125912.73044-1-qasdev00@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Jiri Kosina |
| Headers | show |
| Series | HID: wacom: fix shift OOB in kfifo allocation for zero pktlen | expand |
On Tue, April 1, 2025 at 5:59 AM Qasim Ijaz <qasdev00@gmail.com> wrote: > During wacom_parse_and_register() the code calls wacom_devm_kfifo_alloc > to allocate a fifo. During this operation it passes kfifo_alloc a > fifo_size of 0. Kfifo attempts to round the size passed to it to the > next power of 2 via roundup_pow_of_two (queue-type data structures > do this to maintain efficiency of operations). > > However during this phase a problem arises when the roundup_pow_of_two() > function utilises a shift exponent of fls_long(n-1), where n is the > fifo_size. Since n is 0 in this case and n is also an unsigned long, > doing n-1 causes unsigned integer wrap-around to occur making the > fifo_size 4294967295. So the code effectively does fls_long(4294967295) > which results in 64. Returning back to roundup_pow_of_two(), the code > utilises a shift exponent of 64. When a shift exponent of 64 is used > on a 64-bit type such as 1UL it results in a shift-out-of-bounds. > > The root cause of the issue seems to stem from insufficient validation > of wacom_compute_pktlen(), since in this case the fifo_size comes > from wacom_wac->features.pktlen. During wacom_parse_and_register() > the wacom_compute_pktlen() function sets the pktlen as 0. > > To fix this, we should handle cases where wacom_compute_pktlen() > results in 0. > > Reported-by: syzbot <syzbot+d5204cbbdd921f1f7cad@syzkaller.appspotmail.com> > Closes: https://syzkaller.appspot.com/bug?extid=d5204cbbdd921f1f7cad > Tested-by: Qasim Ijaz <qasdev00@gmail.com> > Cc: stable@vger.kernel.org > Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> > --- > drivers/hid/wacom_sys.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c > index 97393a3083ca..9b2f3dbca467 100644 > --- a/drivers/hid/wacom_sys.c > +++ b/drivers/hid/wacom_sys.c > @@ -2361,6 +2361,8 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless) > unsigned int connect_mask = HID_CONNECT_HIDRAW; > > features->pktlen = wacom_compute_pktlen(hdev); > + if (!features->pktlen) > + return -ENODEV; > > if (!devres_open_group(&hdev->dev, wacom, GFP_KERNEL)) > return -ENOMEM; > -- > 2.39.5 > This looks acceptable to me. Taking a closer look at this area, I have a feeling that 'wacom_compute_pktlen' should also consider feature reports in its calculation (so that we allocate enough space for e.g. GET_FEATURE responses). I'll look into this more over the next few days. Please add the following to the end of the commit description for traceability: > Fixes: 5e013ad20689 ("HID: wacom: Remove static WACOM_PKGLEN_MAX limit") With that modification in place: Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com> -------- Jason Gerecke (she / they), Senior Linux Software Engineer Wacom Technology Corporation tel: 503-525-3100 ext. 3229 (direct) http://www.wacom.com
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 97393a3083ca..9b2f3dbca467 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -2361,6 +2361,8 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless) unsigned int connect_mask = HID_CONNECT_HIDRAW; features->pktlen = wacom_compute_pktlen(hdev); + if (!features->pktlen) + return -ENODEV; if (!devres_open_group(&hdev->dev, wacom, GFP_KERNEL)) return -ENOMEM;