KASAN reports out of bounds memory read in rmi_read_register_desc / drivers/input/rmi4/rmi_driver.c

[Hanno Böck <hanno@xxxxxxxxx>]

Hi,

When booting my laptop (Thinkpad X1 Carbon 2018 edition) with Kernel
Address Sanitizer (KASAN) enabled I get a report for an invalid memory
read.

This happens in the function rmi_read_register_desc in
drivers/input/rmi4/rmi_driver.c

This is the code where this happens:

		++offset;
		if (reg_size == 0) {
			reg_size = struct_buf[offset] |
					(struct_buf[offset + 1] << 8);


I'm not familiar with the context and meaning of that code, so I was
unable to analyze the bug further. Attached is the symbolized kasan
stack trace, hope this helps.

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@xxxxxxxxx
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Attachment: kasan-error-rmi4.txt.gz
Description: application/gzip