A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 19:21:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

HID: fix HIDIOCGRDESC memory access in hidraw

Browse source 
Fix bogus copying of data into userspace when HIDIOCGRDESC is issued.
HID-transport layer makes sure that dev->hid->rdesc is not larger than
HID_MAX_DESCRIPTOR_SIZE.

Noticed-by: Al Viro <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Jiri Kosina 2007-10-15 15:17:41 +02:00 • committed by Linus Torvalds
commit 57d292bd7e
3 changed files with 24 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

12
drivers/hid/hidraw.c
View file

@ -229,9 +229,15 @@ static int hidraw_ioctl(struct inode *inode, struct file *file, unsigned int cmd
if (get_user(len, (int __user *)arg))
return -EFAULT;
if (copy_to_user(*((__u8 **)(user_arg +
sizeof(__u32))),
dev->hid->rdesc, len))
if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
return -EINVAL;
if (copy_to_user(user_arg + offsetof(
struct hidraw_report_descriptor,
value[0]),
dev->hid->rdesc,
min(dev->hid->rsize, len)))
return -EFAULT;
return 0;
}