Input: ims-pcu - add response length checks

The driver processes response data from device buffers without verifying
that the device actually sent enough data. This can lead to
out-of-bounds reads or processing stale data.

Add checks for the expected response length before accessing the
buffers.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 371c605efcf43136f4b0305288003359a026a88f..a730cc2690d5385f3fed64fc6469409ac476a9f7 100644 (file)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -407,7 +407,16 @@ static void ims_pcu_destroy_gamepad(struct ims_pcu *pcu)
 
 static void ims_pcu_report_events(struct ims_pcu *pcu)
 {
-       u32 data = get_unaligned_be32(&pcu->read_buf[3]);
+       u32 data;
+
+       /* 6-axis setting (1 byte) + button data + checksum */
+       if (pcu->read_pos < IMS_PCU_DATA_OFFSET + 1 + sizeof(data) + 1) {
+               dev_warn(pcu->dev, "Short buttons report: %d bytes\n",
+                        pcu->read_pos);
+               return;
+       }
+
+       data = get_unaligned_be32(&pcu->read_buf[IMS_PCU_DATA_OFFSET + 1]);
 
        ims_pcu_buttons_report(pcu, data & ~IMS_PCU_GAMEPAD_MASK);
        if (pcu->gamepad)
@@ -687,11 +696,19 @@ static int __ims_pcu_execute_bl_command(struct ims_pcu *pcu,
                return error;
        }
 
-       if (expected_response && pcu->cmd_buf[2] != expected_response) {
-               dev_err(pcu->dev,
-                       "Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n",
-                       pcu->cmd_buf[2], expected_response);
-               return -EINVAL;
+       if (expected_response) {
+               if (pcu->cmd_buf_len < 3) {
+                       dev_err(pcu->dev, "Short response from bootloader: %d bytes\n",
+                               pcu->cmd_buf_len);
+                       return -EIO;
+               }
+
+               if (pcu->cmd_buf[2] != expected_response) {
+                       dev_err(pcu->dev,
+                               "Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n",
+                               pcu->cmd_buf[2], expected_response);
+                       return -EINVAL;
+               }
        }
 
        return 0;
@@ -719,6 +736,12 @@ static int ims_pcu_get_info(struct ims_pcu *pcu)
                return error;
        }
 
+       if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + IMS_PCU_SET_INFO_SIZE + 1) {
+               dev_err(pcu->dev, "Short GET_INFO response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               return -EIO;
+       }
+
        memcpy(pcu->part_number,
               &pcu->cmd_buf[IMS_PCU_INFO_PART_OFFSET],
               sizeof(pcu->part_number));
@@ -816,6 +839,12 @@ static int ims_pcu_verify_block(struct ims_pcu *pcu,
                return error;
        }
 
+       if (pcu->cmd_buf_len < IMS_PCU_BL_DATA_OFFSET + sizeof(*fragment) + len + 1) {
+               dev_err(pcu->dev, "Short READ_APP response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               return -EIO;
+       }
+
        fragment = (void *)&pcu->cmd_buf[IMS_PCU_BL_DATA_OFFSET];
        if (get_unaligned_le32(&fragment->addr) != addr ||
            fragment->len != len) {
@@ -1009,6 +1038,10 @@ ims_pcu_backlight_get_brightness(struct led_classdev *cdev)
                         error);
                /* Assume the LED is OFF */
                brightness = LED_OFF;
+       } else if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 2 + 1) {
+               dev_err(pcu->dev, "Short GET_BRIGHTNESS response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               brightness = LED_OFF;
        } else {
                brightness =
                        get_unaligned_le16(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
@@ -1287,6 +1320,12 @@ static int ims_pcu_read_ofn_config(struct ims_pcu *pcu, u8 addr, u8 *data)
        if (error)
                return error;
 
+       if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) {
+               dev_err(pcu->dev, "Short OFN_GET_CONFIG response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               return -EIO;
+       }
+
        result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET);
        if (result < 0)
                return -EIO;
@@ -1307,6 +1346,12 @@ static int ims_pcu_write_ofn_config(struct ims_pcu *pcu, u8 addr, u8 data)
        if (error)
                return error;
 
+       if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) {
+               dev_err(pcu->dev, "Short OFN_SET_CONFIG response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               return -EIO;
+       }
+
        result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET);
        if (result < 0)
                return -EIO;
@@ -1850,6 +1895,12 @@ static int ims_pcu_get_device_info(struct ims_pcu *pcu)
                return error;
        }
 
+       if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) {
+               dev_err(pcu->dev, "Short GET_FW_VERSION response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               return -EIO;
+       }
+
        snprintf(pcu->fw_version, sizeof(pcu->fw_version),
                 "%02d%02d%02d%02d.%c%c",
                 pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
@@ -1862,6 +1913,12 @@ static int ims_pcu_get_device_info(struct ims_pcu *pcu)
                return error;
        }
 
+       if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) {
+               dev_err(pcu->dev, "Short GET_BL_VERSION response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               return -EIO;
+       }
+
        snprintf(pcu->bl_version, sizeof(pcu->bl_version),
                 "%02d%02d%02d%02d.%c%c",
                 pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
@@ -1874,6 +1931,12 @@ static int ims_pcu_get_device_info(struct ims_pcu *pcu)
                return error;
        }
 
+       if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) {
+               dev_err(pcu->dev, "Short RESET_REASON response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               return -EIO;
+       }
+
        snprintf(pcu->reset_reason, sizeof(pcu->reset_reason),
                 "%02x", pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
 
@@ -1900,6 +1963,12 @@ static int ims_pcu_identify_type(struct ims_pcu *pcu, u8 *device_id)
                return error;
        }
 
+       if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) {
+               dev_err(pcu->dev, "Short GET_DEVICE_ID response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               return -EIO;
+       }
+
        *device_id = pcu->cmd_buf[IMS_PCU_DATA_OFFSET];
        dev_dbg(pcu->dev, "Detected device ID: %d\n", *device_id);
 
@@ -1991,6 +2060,12 @@ static int ims_pcu_init_bootloader_mode(struct ims_pcu *pcu)
                return error;
        }
 
+       if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 15 + 4 + 1) {
+               dev_err(pcu->dev, "Short QUERY_DEVICE response: %d bytes\n",
+                       pcu->cmd_buf_len);
+               return -EIO;
+       }
+
        pcu->fw_start_addr =
                get_unaligned_le32(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET + 11]);
        pcu->fw_end_addr =