Re: [PATCH] Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

[Dmitry Torokhov]

On Mon, Apr 20, 2026 at 06:00:27PM +0200, Greg Kroah-Hartman wrote:
> nexio_read_data() pulls data_len and x_len from a packed __be16 header
> in the device's interrupt packet and then walks packet->data[0..x_len)
> and packet->data[x_len..data_len) comparing each byte against a
> threshold.
> 
> Both fields are 16-bit on the wire (max 65535).  The existing
> adjustments shave at most 0x100 / 0x80 off, so the loop bound can still
> reach roughly 0xfeff.  The URB transfer buffer for NEXIO is rept_size
> (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the
> packed header — so packet->data[] has 1017 valid bytes.  read_data()
> callbacks are not given urb->actual_length, and nothing else bounds the
> walk.
> 
> A device that lies about its length can get a ~64 KiB out-of-bounds read
> past the coherent DMA allocation.  The first index whose byte exceeds
> NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the
> reported touch coordinates, so adjacent kernel memory contents leak to
> userspace as ABS_X / ABS_Y events.  Far enough out, the read can also
> hit an unmapped page and fault.
> 
> Fix this all by clamping data_len to the buffer's data[] capacity and
> x_len to data_len.
> 
> Cc: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
> Fixes: 5197424cdccc ("Input: usbtouchscreen - add NEXIO (or iNexio) support")
> Cc: stable <stable@xxxxxxxxxx>
> Assisted-by: gkh_clanker_t1000
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

Applied, thank you.

-- 
Dmitry