[PATCH 01/10] HID: alps: reject short input reports

[Jiale Yao]

The HID core invokes a driver's raw_event callback before validating the
report length.  Both ALPS input parsers therefore need to validate size
before accessing their fixed-format reports.

t4_raw_event() casts the buffer to struct t4_input_report and reads its
contacts and button.  u1_raw_event() reads five bytes per configured finger
starting at offset three, or six bytes for a stick report.  A short report
can make either parser read beyond the valid data.

Reject reports that do not contain all fields used by the selected parser.

Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: 2562756dde55 ("HID: add Alps I2C HID Touchpad-Stick support")
Fixes: 73196ebe134d ("HID: alps: add support for Alps T4 Touchpad device")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/hid/hid-alps.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
index 67179e3fe39b..b1950aff6ad4 100644
--- a/drivers/hid/hid-alps.c
+++ b/drivers/hid/hid-alps.c
@@ -322,7 +322,7 @@ static int t4_raw_event(struct alps_dev *hdata, u8 *data, int size)
 	int i;
 	struct t4_input_report *p_report = (struct t4_input_report *)data;
 
-	if (!data)
+	if (size < sizeof(*p_report))
 		return 0;
 	for (i = 0; i < hdata->max_fingers; i++) {
 		x = p_report->contact[i].x_hi << 8 | p_report->contact[i].x_lo;
@@ -370,6 +370,9 @@ static int u1_raw_event(struct alps_dev *hdata, u8 *data, int size)
 		break;
 	case U1_ABSOLUTE_REPORT_ID:
 	case U1_ABSOLUTE_REPORT_ID_SECD:
+		if (size < 3 + hdata->max_fingers * 5)
+			return 0;
+
 		for (i = 0; i < hdata->max_fingers; i++) {
 			u8 *contact = &data[i * 5];
 
@@ -407,6 +410,9 @@ static int u1_raw_event(struct alps_dev *hdata, u8 *data, int size)
 		return 1;
 
 	case U1_SP_ABSOLUTE_REPORT_ID:
+		if (size < 6)
+			return 0;
+
 		sp_x = get_unaligned_le16(data+2);
 		sp_y = get_unaligned_le16(data+4);
 
-- 
2.34.1