HID: playstation: Clamp num_touch_reports

A device would never lie about the number of touch reports would it?

If it does the loop in dualshock4_parse_report will read off the end of
the touch_reports array, up to about 2 KiB for the maximum number of 256
loop iteraions. The data that is read is emitted via evdev if the
DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by
clamping the num_touch_reports value provided by the device to the
maximum size of the touch_reports array.

Fixes: 752038248808 ("HID: playstation: add DualShock4 touchpad support.")
Cc: stable@vger.kernel.org
Reported-by: Xingyu Jin <xingyuj@google.com>
Signed-off-by: T.J. Mercier <tjmercier@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>

diff --git a/drivers/hid/hid-playstation.c b/drivers/hid/hid-playstation.c
index c43caac20b61b1744b403c552b4cffcb3e9af40c..e485373316756a227670bf514ccacf62bf658534 100644 (file)
--- a/drivers/hid/hid-playstation.c
+++ b/drivers/hid/hid-playstation.c
@@ -2384,7 +2384,8 @@ static int dualshock4_parse_report(struct ps_device *ps_dev, struct hid_report *
                }
 
                ds4_report = &usb->common;
-               num_touch_reports = usb->num_touch_reports;
+               num_touch_reports = min_t(u8, usb->num_touch_reports,
+                                         ARRAY_SIZE(usb->touch_reports));
                touch_reports = usb->touch_reports;
        } else if (hdev->bus == BUS_BLUETOOTH && report->id == DS4_INPUT_REPORT_BT &&
                   size == DS4_INPUT_REPORT_BT_SIZE) {
@@ -2404,7 +2405,8 @@ static int dualshock4_parse_report(struct ps_device *ps_dev, struct hid_report *
                }
 
                ds4_report = &bt->common;
-               num_touch_reports = bt->num_touch_reports;
+               num_touch_reports = min_t(u8, bt->num_touch_reports,
+                                         ARRAY_SIZE(bt->touch_reports));
                touch_reports = bt->touch_reports;
        } else if (hdev->bus == BUS_BLUETOOTH &&
                   report->id == DS4_INPUT_REPORT_BT_MINIMAL &&