Re: [PATCH] Input: mms114 - reject an oversized device packet size

[Dmitry Torokhov]

On Fri, Jun 12, 2026 at 11:21:14PM -0500, Bryam Vargas via B4 Relay wrote:
> From: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> 
> mms114_interrupt() reads a packet of touch data from the device into a
> fixed-size on-stack buffer
> 
> 	struct mms114_touch touch[MMS114_MAX_TOUCH];
> 
> which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,
> i.e. 80 bytes. The length of the I2C read into it is taken verbatim from
> the device:
> 
> 	packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE);
> 	if (packet_size <= 0)
> 		goto out;
> 	...
> 	error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,
> 			(u8 *)touch);
> 
> packet_size is a single device register byte (0x0F) and the only check
> is the lower bound packet_size <= 0; it is never bounded against the
> size of touch[]. A malfunctioning, malicious or counterfeit controller
> (or an attacker tampering with the I2C bus) can report a packet_size of
> up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of
> touch[] on the IRQ-thread stack: a stack out-of-bounds write that can
> overwrite the stack canary, saved registers and the return address.
> 
> A well-formed device never reports more than the buffer holds, so reject
> an oversized packet and drop the report, consistent with the handler's
> other error paths, rather than reading past the buffer.
> 
> Fixes: 07b8481d4aff ("Input: add MELFAS mms114 touchscreen driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> ---
>  drivers/input/touchscreen/mms114.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
> index af462086a65c..4c75f16c503d 100644
> --- a/drivers/input/touchscreen/mms114.c
> +++ b/drivers/input/touchscreen/mms114.c
> @@ -226,6 +226,13 @@ static irqreturn_t mms114_interrupt(int irq, void *dev_id)
>  	if (packet_size <= 0)
>  		goto out;
>  
> +	/* the device controls packet_size; reject anything too big for touch[] */
> +	if (packet_size > (int)sizeof(touch)) {

I gonna drop this cast (as thankfully we are not using -Wsign-compare)
and apply, thank you.

Thanks.

-- 
Dmitry