Messages in this thread | | | Date | Fri, 13 Dec 2019 21:42:34 +0100 (CET) | From | Jiri Kosina <> | Subject | Re: [PATCH v2] HID: hid-input: clear unmapped usages |
| |
On Fri, 13 Dec 2019, Benjamin Tissoires wrote:
> > > We should not be leaving half-mapped usages with potentially invalid > > > keycodes, as that may confuse hidinput_find_key() when the key is located > > > by index, which may end up feeding way too large keycode into the VT > > > keyboard handler and cause OOB write there: > > > > > > BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline] > > > BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] > > > BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 > > > Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722 > > > ... > > > kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] > > > kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 > > > input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118 > > > input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145 > > > input_pass_values drivers/input/input.c:949 [inline] > > > input_set_keycode+0x290/0x320 drivers/input/input.c:954 > > > evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882 > > > evdev_do_ioctl drivers/input/evdev.c:1150 [inline] > > > > > > Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com > > > Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> > > > --- > > > > > > v2: fixed up interaction with hid-multitouch according to Benjamin's > > > feedback > > > > > > Please consider tagging for stable. > > > > I'd like to push this for 5.5 (and tag for stable), but would prefer this > > to have gone through the full battery of Benjamin's testing infrastructure > > first. > > > > Benjamin, did you have chance to run Dmitry's patch through your > > machinery? > > yep, this one was OK, so: > Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Thanks, I am queuing this in for-5.5/upstream-fixes.
-- Jiri Kosina SUSE Labs
| |