[PATCH] HID: goodix: validate coordinate package length

[Jiale Yao]

The coordinate package length comes from the device.  goodix_hid_irq()
checks only that it contains the length field before passing the
remaining length to hid_input_report().  A package length larger than
the fixed coordinate buffer therefore makes the HID core read beyond
the data fetched from the device.

Reject coordinate packages whose declared length exceeds the coordinate
buffer.

Fixes: 75e16c8ce283 ("HID: hid-goodix: Add Goodix HID-over-SPI driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/hid/hid-goodix-spi.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-goodix-spi.c b/drivers/hid/hid-goodix-spi.c
index 03d549efbdce..eb63ee728a20 100644
--- a/drivers/hid/hid-goodix-spi.c
+++ b/drivers/hid/hid-goodix-spi.c
@@ -574,6 +574,7 @@ static irqreturn_t goodix_hid_irq(int irq, void *data)
 	struct goodix_ts_data *ts = data;
 	struct goodix_hid_report_event *event;
 	struct goodix_hid_report_package *pkg;
+	u16 package_size;
 	u16 report_size;
 
 	if (!test_bit(GOODIX_HID_STARTED, &ts->flags))
@@ -600,13 +601,15 @@ static irqreturn_t goodix_hid_irq(int irq, void *data)
 		return IRQ_HANDLED;
 
 	pkg = (struct goodix_hid_report_package *)event->data;
-	if (le16_to_cpu(pkg->size) < GOODIX_HID_PKG_LEN_SIZE) {
+	package_size = le16_to_cpu(pkg->size);
+	if (package_size < GOODIX_HID_PKG_LEN_SIZE ||
+	    package_size > GOODIX_HID_COOR_PKG_LEN) {
 		dev_err(ts->dev, "invalid coordinate event package size, %d",
-			le16_to_cpu(pkg->size));
+			package_size);
 		return IRQ_HANDLED;
 	}
 	hid_input_report(ts->hid, HID_INPUT_REPORT, pkg->data,
-			 le16_to_cpu(pkg->size) - GOODIX_HID_PKG_LEN_SIZE, 1);
+			 package_size - GOODIX_HID_PKG_LEN_SIZE, 1);
 
 	report_size = le16_to_cpu(event->hdr.size);
 	/* Check if there are other packages */
-- 
2.34.1