[PATCH] HID: goodix: validate attachment package length

[Shengzhuo Wei]

goodix_hid_irq() reads the attachment package using the event header's
length, but passes the independent pkg->size to hid_input_report()
without checking it against the bytes read.  An oversized package can
forward stale buffer contents or cause an out-of-bounds read, exposing
those bytes to hidraw readers.

Reject package sizes smaller than the two-byte length field or larger
than the requested read length.

Reported-by: Maoyi Xie <maoyixie.tju@xxxxxxxxx>
Link: https://lore.kernel.org/all/178212703386.2270604.12694603282649418418@xxxxxxxxxxxx/
Link: https://lore.kernel.org/all/20261028050901.139292-1-yaojiale02@xxxxxxx/
Fixes: 75e16c8ce283 ("HID: hid-goodix: Add Goodix HID-over-SPI driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
---
Validated by source analysis, simulated SPI/HID callbacks and object
compilation. No kernel/hardware runtime A/B was performed.
---
 drivers/hid/hid-goodix-spi.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-goodix-spi.c b/drivers/hid/hid-goodix-spi.c
index 03d549efbdce..b7092b85dda2 100644
--- a/drivers/hid/hid-goodix-spi.c
+++ b/drivers/hid/hid-goodix-spi.c
@@ -575,6 +575,7 @@ static irqreturn_t goodix_hid_irq(int irq, void *data)
 	struct goodix_hid_report_event *event;
 	struct goodix_hid_report_package *pkg;
 	u16 report_size;
+	u32 pkg_len;
 
 	if (!test_bit(GOODIX_HID_STARTED, &ts->flags))
 		return IRQ_HANDLED;
@@ -620,14 +621,21 @@ static irqreturn_t goodix_hid_irq(int irq, void *data)
 	}
 
 	/* Read the package behind the coordinate data */
+	pkg_len = report_size - GOODIX_HID_COOR_PKG_LEN;
 	pkg = goodix_get_event_report(ts, ts->hid_report_addr + sizeof(*event),
-				      ts->event_buf,
-				      report_size - GOODIX_HID_COOR_PKG_LEN);
+				      ts->event_buf, pkg_len);
 	if (!pkg) {
 		dev_err(ts->dev, "failed read attachment data content");
 		return IRQ_HANDLED;
 	}
 
+	if (le16_to_cpu(pkg->size) < GOODIX_HID_PKG_LEN_SIZE ||
+	    le16_to_cpu(pkg->size) > pkg_len) {
+		dev_err(ts->dev, "invalid attachment event package size, %d",
+			le16_to_cpu(pkg->size));
+		return IRQ_HANDLED;
+	}
+
 	hid_input_report(ts->hid, HID_INPUT_REPORT, pkg->data,
 			 le16_to_cpu(pkg->size) - GOODIX_HID_PKG_LEN_SIZE, 1);
 

---
base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
change-id: 20261028-b4-goodix-attachment-pkg-size-3c7a69d6d4c4

Best regards,
--  
Shengzhuo Wei <me@xxxxxxxx>