goodix_hid_irq() reads the attachment package using the event header's length, but passes the independent pkg->size to hid_input_report() without checking it against the bytes read. An oversized package can forward stale buffer contents or cause an out-of-bounds read, exposing those bytes to hidraw readers. Reject package sizes smaller than the two-byte length field or larger than the requested read length. Reported-by: Maoyi Xie Link: https://lore.kernel.org/all/178212703386.2270604.12694603282649418418@maoyixie.com/ Link: https://lore.kernel.org/all/20261028050901.139292-1-yaojiale02@163.com/ Fixes: 75e16c8ce283 ("HID: hid-goodix: Add Goodix HID-over-SPI driver") Cc: stable@vger.kernel.org Signed-off-by: Shengzhuo Wei --- Validated by source analysis, simulated SPI/HID callbacks and object compilation. No kernel/hardware runtime A/B was performed. --- drivers/hid/hid-goodix-spi.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-goodix-spi.c b/drivers/hid/hid-goodix-spi.c index 03d549efbdce..b7092b85dda2 100644 --- a/drivers/hid/hid-goodix-spi.c +++ b/drivers/hid/hid-goodix-spi.c @@ -575,6 +575,7 @@ static irqreturn_t goodix_hid_irq(int irq, void *data) struct goodix_hid_report_event *event; struct goodix_hid_report_package *pkg; u16 report_size; + u32 pkg_len; if (!test_bit(GOODIX_HID_STARTED, &ts->flags)) return IRQ_HANDLED; @@ -620,14 +621,21 @@ static irqreturn_t goodix_hid_irq(int irq, void *data) } /* Read the package behind the coordinate data */ + pkg_len = report_size - GOODIX_HID_COOR_PKG_LEN; pkg = goodix_get_event_report(ts, ts->hid_report_addr + sizeof(*event), - ts->event_buf, - report_size - GOODIX_HID_COOR_PKG_LEN); + ts->event_buf, pkg_len); if (!pkg) { dev_err(ts->dev, "failed read attachment data content"); return IRQ_HANDLED; } + if (le16_to_cpu(pkg->size) < GOODIX_HID_PKG_LEN_SIZE || + le16_to_cpu(pkg->size) > pkg_len) { + dev_err(ts->dev, "invalid attachment event package size, %d", + le16_to_cpu(pkg->size)); + return IRQ_HANDLED; + } + hid_input_report(ts->hid, HID_INPUT_REPORT, pkg->data, le16_to_cpu(pkg->size) - GOODIX_HID_PKG_LEN_SIZE, 1); --- base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e change-id: 20261028-b4-goodix-attachment-pkg-size-3c7a69d6d4c4 Best regards, -- Shengzhuo Wei