Commit ad3e14d7c5268c2e24477c6ef54bbdf88add5d36
1 parent
51217e6969
Exists in
ti-lsk-linux-4.1.y
and in
10 other branches
HID: logitech: perform bounds checking on device_id early enough
device_index is a char type and the size of paired_dj_deivces is 7 elements, therefore proper bounds checking has to be applied to device_index before it is used. We are currently performing the bounds checking in logi_dj_recv_add_djhid_device(), which is too late, as malicious device could send REPORT_TYPE_NOTIF_DEVICE_UNPAIRED early enough and trigger the problem in one of the report forwarding functions called from logi_dj_raw_event(). Fix this by performing the check at the earliest possible ocasion in logi_dj_raw_event(). Cc: stable@vger.kernel.org Reported-by: Ben Hawkes <hawkes@google.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Showing 1 changed file with 6 additions and 7 deletions Side-by-side Diff
drivers/hid/hid-logitech-dj.c
... | ... | @@ -238,13 +238,6 @@ |
238 | 238 | return; |
239 | 239 | } |
240 | 240 | |
241 | - if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) || | |
242 | - (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) { | |
243 | - dev_err(&djrcv_hdev->dev, "%s: invalid device index:%d\n", | |
244 | - __func__, dj_report->device_index); | |
245 | - return; | |
246 | - } | |
247 | - | |
248 | 241 | if (djrcv_dev->paired_dj_devices[dj_report->device_index]) { |
249 | 242 | /* The device is already known. No need to reallocate it. */ |
250 | 243 | dbg_hid("%s: device is already known\n", __func__); |
... | ... | @@ -690,6 +683,12 @@ |
690 | 683 | * device (via hid_input_report() ) and return 1 so hid-core does not do |
691 | 684 | * anything else with it. |
692 | 685 | */ |
686 | + if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) || | |
687 | + (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) { | |
688 | + dev_err(&hdev->dev, "%s: invalid device index:%d\n", | |
689 | + __func__, dj_report->device_index); | |
690 | + return false; | |
691 | + } | |
693 | 692 | |
694 | 693 | spin_lock_irqsave(&djrcv_dev->lock, flags); |
695 | 694 | if (dj_report->report_id == REPORT_ID_DJ_SHORT) { |
-
mentioned in commit 2ae8a6
-
mentioned in commit b165b8
-
mentioned in commit b165b8
-
mentioned in commit c84e10
-
mentioned in commit c84e10
-
mentioned in commit b165b8
-
mentioned in commit c84e10
-
mentioned in commit b165b8
-
mentioned in commit c84e10
-
mentioned in commit b165b8
-
mentioned in commit c84e10
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8
-
mentioned in commit 5abfe8