lkml.org 
[lkml]   [2020]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [Linux-kernel-mentees] [PATCH v1] usbhid: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
On Sat, Jul 18, 2020 at 07:12:18PM -0400, Peilin Ye wrote:
> `uref->usage_index` is not always being properly checked, causing
> hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.
>

Yeah. This code is not obvious. It doesn't come from the user directly
so we don't have to worry about nospec. It comes from hiddev_lookup_usage()
where we set:

uref->usage_index = j;

We know that j is less than field->maxusage but we do need to check
against field->report_count like your patch does... The two arrays
are allocated in hid_register_field().

I don't know the code well enough to say how these arrays are used or
why the one is larger than the other so I can't give a proper
reviewed-by. But the patch looks reasonable and doesn't introduce any
bugs which weren't there in the original code.

regards,
dan carpenter

\
 
 \ /
  Last update: 2020-07-20 13:54    [W:0.124 / U:1.272 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site