lkml.org 
[lkml]   [2022]   [May]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.15 060/109] HID: bigben: fix slab-out-of-bounds Write in bigben_probe
    Date
    From: Dongliang Mu <mudongliangabcd@gmail.com>

    [ Upstream commit fc4ef9d5724973193bfa5ebed181dba6de3a56db ]

    There is a slab-out-of-bounds Write bug in hid-bigbenff driver.
    The problem is the driver assumes the device must have an input but
    some malicious devices violate this assumption.

    Fix this by checking hid_device's input is non-empty before its usage.

    Reported-by: syzkaller <syzkaller@googlegroups.com>
    Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/hid/hid-bigbenff.c | 6 ++++++
    1 file changed, 6 insertions(+)

    diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
    index 74ad8bf98bfd..e8c5e3ac9fff 100644
    --- a/drivers/hid/hid-bigbenff.c
    +++ b/drivers/hid/hid-bigbenff.c
    @@ -347,6 +347,12 @@ static int bigben_probe(struct hid_device *hid,
    bigben->report = list_entry(report_list->next,
    struct hid_report, list);

    + if (list_empty(&hid->inputs)) {
    + hid_err(hid, "no inputs found\n");
    + error = -ENODEV;
    + goto error_hw_stop;
    + }
    +
    hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
    set_bit(FF_RUMBLE, hidinput->input->ffbit);

    --
    2.35.1
    \
     
     \ /
      Last update: 2022-05-30 16:14    [W:3.024 / U:0.200 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site