No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Alan Stern 2cc7eb6562 HID: Fix slab-out-of-bounds read in hid_field_extract
commit 8ec321e96e056de84022c032ffea253431a83c3c upstream.

The syzbot fuzzer found a slab-out-of-bounds bug in the HID report
handler.  The bug was caused by a report descriptor which included a
field with size 12 bits and count 4899, for a total size of 7349
bytes.

The usbhid driver uses at most a single-page 4-KB buffer for reports.
In the test there wasn't any problem about overflowing the buffer,
since only one byte was received from the device.  Rather, the bug
occurred when the HID core tried to extract the data from the report
fields, which caused it to try reading data beyond the end of the
allocated buffer.

This patch fixes the problem by rejecting any report whose total
length exceeds the HID_MAX_BUFFER_SIZE limit (minus one byte to allow
for a possible report index).  In theory a device could have a report
longer than that, but if there was such a thing we wouldn't handle it
correctly anyway.

Reported-and-tested-by: syzbot+09ef48aa58261464b621@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-14 20:08:23 +01:00
arch parisc: Fix compiler warnings in debug_core.c 2020-01-12 12:21:44 +01:00
block block: fix memleak when __blk_rq_map_user_iov() is failed 2020-01-12 12:21:43 +01:00
certs
crypto KEYS: asymmetric: return ENOMEM if akcipher_request_alloc() fails 2019-12-31 16:46:07 +01:00
Documentation dt-bindings: clock: renesas: rcar-usb2-clock-sel: Fix typo in example 2020-01-09 10:20:05 +01:00
drivers HID: Fix slab-out-of-bounds read in hid_field_extract 2020-01-14 20:08:23 +01:00
fs chardev: Avoid potential use-after-free in 'chrdev_open()' 2020-01-14 20:08:18 +01:00
include tracing: Change offset type to s32 in preempt/irq tracepoints 2020-01-14 20:08:22 +01:00
init Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2019-09-28 08:14:15 -07:00
ipc ipc/sem.c: convert to use built-in RCU list checking 2019-09-25 17:51:41 -07:00
kernel tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined 2020-01-14 20:08:22 +01:00
lib sbitmap: only queue kyber's wait callback if not already active 2020-01-12 12:21:44 +01:00
LICENSES
mm mm/hugetlb: defer freeing of huge pages if in non-task context 2020-01-09 10:20:07 +01:00
net vlan: vlan_changelink() should propagate errors 2020-01-12 12:21:50 +01:00
samples samples: bpf: fix syscall_tp due to unused syscall 2020-01-12 12:21:26 +01:00
scripts scripts: package: mkdebian: add missing rsync dependency 2020-01-12 12:21:35 +01:00
security apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock 2020-01-09 10:20:00 +01:00
sound ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th gen 2020-01-14 20:08:20 +01:00
tools selftests: pmtu: fix init mtu value in description 2020-01-12 12:21:45 +01:00
usr gen_initramfs_list.sh: fix 'bad variable name' error 2020-01-09 10:20:00 +01:00
virt KVM: arm/arm64: Properly handle faulting of device mappings 2019-12-31 16:46:24 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Modules updates for v5.4 2019-09-22 10:34:46 -07:00
.mailmap ARM: SoC fixes 2019-11-10 13:41:59 -08:00
COPYING
CREDITS MAINTAINERS: Remove Simon as Renesas SoC Co-Maintainer 2019-10-10 08:12:51 -07:00
Kbuild
Kconfig
MAINTAINERS Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-22 14:28:14 -08:00
Makefile Linux 5.4.11 2020-01-12 12:21:53 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.