]> git.ipfire.org Git - thirdparty/linux.git/commit
Input: ims-pcu - add response length checks
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Fri, 22 May 2026 17:40:54 +0000 (10:40 -0700)
committerDmitry Torokhov <dmitry.torokhov@gmail.com>
Sun, 7 Jun 2026 04:05:16 +0000 (21:05 -0700)
commit48c9d92fd4ee3a8f5d2cb46c802a0eff8e67c79c
treed6b224ce73c1de51f0ae68a86a616e95b7f4dcc4
parent8adf4289d945e8990e4336436a97da71d21d2cae
Input: ims-pcu - add response length checks

The driver processes response data from device buffers without verifying
that the device actually sent enough data. This can lead to
out-of-bounds reads or processing stale data.

Add checks for the expected response length before accessing the
buffers.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
drivers/input/misc/ims-pcu.c