Alan Stern
2cc7eb6562
HID: Fix slab-out-of-bounds read in hid_field_extract ...
commit 8ec321e96e056de84022c032ffea253431a83c3c upstream.
The syzbot fuzzer found a slab-out-of-bounds bug in the HID report
handler. The bug was caused by a report descriptor which included a
field with size 12 bits and count 4899, for a total size of 7349
bytes.
The usbhid driver uses at most a single-page 4-KB buffer for reports.
In the test there wasn't any problem about overflowing the buffer,
since only one byte was received from the device. Rather, the bug
occurred when the HID core tried to extract the data from the report
fields, which caused it to try reading data beyond the end of the
allocated buffer.
This patch fixes the problem by rejecting any report whose total
length exceeds the HID_MAX_BUFFER_SIZE limit (minus one byte to allow
for a possible report index). In theory a device could have a report
longer than that, but if there was such a thing we wouldn't handle it
correctly anyway.
Reported-and-tested-by: syzbot+09ef48aa58261464b621@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-14 20:08:23 +01:00
ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100
2020-01-09 10:20:02 +01:00
ARM updates for 5.4-rc:
2019-10-23 06:26:33 -04:00
binder: fix incorrect calculation for num_valid
2019-12-17 19:55:33 +01:00
libata: Fix retrieving of active qcs
2020-01-09 10:19:59 +01:00
firmware_loader: Fix labels with comma for builtin firmware
2019-12-31 16:45:39 +01:00
xen/blkback: Avoid unmapping unmapped grant pages
2020-01-09 10:20:07 +01:00
Bluetooth: btusb: fix PM leak in error case of setup
2020-01-09 10:20:04 +01:00
bus: ti-sysc: Fix missing reset delay handling
2020-01-12 12:21:27 +01:00
cdrom: respect device capabilities during opening action
2020-01-04 19:18:25 +01:00
tpm: Handle negative priv->response_len in tpm_common_read()
2020-01-14 20:08:21 +01:00
clk: Move clk_core_reparent_orphans() under CONFIG_OF
2020-01-12 12:21:39 +01:00
clocksource: riscv: add notrace to riscv_sched_clock
2020-01-09 10:19:59 +01:00
cpufreq: Register drivers only after CPU devices have been registered
2019-12-31 16:45:26 +01:00
cpuidle: use first valid target residency as poll time
2019-12-17 19:56:23 +01:00
crypto: vmx - Avoid weird build failures
2019-12-31 16:45:45 +01:00
PM / devfreq: Check NULL governor in available_governors_show
2020-01-09 10:20:01 +01:00
dmaengine: virt-dma: Fix access after free in vchan_complete()
2020-01-09 10:20:00 +01:00
dma-buf: Fix memory leak in sync_file_merge()
2019-12-21 11:04:48 +01:00
EDAC/ghes: Fix grain calculation
2019-12-31 16:45:16 +01:00
extcon: sm5502: Reset registers during initialization
2019-12-31 16:44:04 +01:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:20:06 +01:00
efi/earlycon: Remap entire framebuffer after page initialization
2020-01-12 12:21:16 +01:00
fsi: core: Fix small accesses and unaligned offsets via sysfs
2019-12-31 16:45:09 +01:00
gpio: Handle counting of Freescale chipselects
2020-01-12 12:21:12 +01:00
drm/exynos: gsc: add missed component_del
2020-01-12 12:21:41 +01:00
HID: Fix slab-out-of-bounds read in hid_field_extract
2020-01-14 20:08:23 +01:00
Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic
2020-01-04 19:18:21 +01:00
hwmon: (ina3221) Fix read timeout issue
2019-10-28 18:46:55 -07:00
intel_th: msu: Fix window switching without windows
2019-12-31 16:46:09 +01:00
i2c: fix bus recovery stop mode timing
2020-01-14 20:08:18 +01:00
iio: adc: max9611: Fix too short conversion time delay
2020-01-09 10:19:43 +01:00
IB/mlx5: Fix steering rule of drop and count
2020-01-09 10:19:50 +01:00
Input: ili210x - handle errors from input_mt_init_slots()
2020-01-04 19:17:34 +01:00
interconnect: qcom: qcs404: Walk the list safely on node removal
2019-12-17 19:55:39 +01:00
iommu/dma: Relax locking in iommu_dma_prepare_msi()
2020-01-12 12:21:38 +01:00
irqchip: ingenic: Error out if IRQ domain creation failed
2020-01-04 19:17:22 +01:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-10-28 13:33:41 -07:00
leds: trigger: netdev: fix handling on interface rename
2020-01-04 19:17:05 +01:00
cpufreq: Use per-policy frequency QoS
2019-10-21 02:05:21 +02:00
mailbox: imx: Fix Tx doorbell shutdown path
2020-01-04 19:18:30 +01:00
md: raid1: check rdev before reference in raid1_sync_request func
2020-01-09 10:19:48 +01:00
media: usb: fix memory leak in af9005_identify_state
2020-01-09 10:20:05 +01:00
mfd: mt6397: Fix probe after changing mt6397-core
2019-10-24 08:49:25 +01:00
habanalabs: remove variable 'val' set but not used
2020-01-12 12:21:31 +01:00
mmc: sdhci-of-esdhc: re-implement erratum A-009204 workaround
2020-01-04 19:19:19 +01:00
mtd: rawnand: Change calculating of position page containing BBM
2019-12-17 19:55:54 +01:00
net/mlx5: DR, Init lists that are used in rule's member
2020-01-12 12:21:51 +01:00
NFC: nxp-nci: Fix probing without ACPI
2019-12-31 16:41:49 +01:00
libnvdimm/btt: fix variable 'rc' set but not used
2020-01-04 19:18:12 +01:00
nvme/pci: Fix read queue count
2020-01-09 10:19:43 +01:00
nvmem: imx-ocotp: reset error status on probe
2019-12-31 16:44:42 +01:00
of: overlay: add_changeset_property() memory leak
2020-01-09 10:20:03 +01:00
opp: Reinitialize the list_kref before adding the static OPPs again
2019-10-23 10:58:44 +05:30
parisc: Remove 32-bit DMA enforcement from sba_iommu
2019-10-14 21:44:26 +02:00
parport: load lowlevel driver if ports not found
2019-12-31 16:45:25 +01:00
PCI: Add a helper to check Power Resource Requirements _PR3 existence
2020-01-09 10:19:52 +01:00
perf/smmuv3: Remove the leftover put_cpu() in error path
2020-01-12 12:21:38 +01:00
phy: renesas: rcar-gen3-usb2: Use platform_get_irq_optional() for optional irq
2020-01-09 10:20:05 +01:00
pinctrl: pinmux: fix a possible null pointer in pinmux_can_be_used_for_gpio
2020-01-12 12:21:28 +01:00
platform/x86: pcengines-apuv2: fix simswap GPIO assignment
2020-01-12 12:21:42 +01:00
power: supply: cpcap-battery: Check voltage before orderly_poweroff
2019-12-31 16:44:12 +01:00
powercap: intel_rapl: add NULL pointer check to rapl_mmio_cpu_online()
2020-01-14 20:08:18 +01:00
ptp: fix the race between the release of ptp_clock and cdev
2020-01-04 19:18:48 +01:00
pwm: bcm-iproc: Prevent unloading the driver module while in use
2019-11-08 18:38:06 +01:00
regulator: rn5t618: fix module aliases
2020-01-12 12:21:34 +01:00
reset: Do not register resource data for missing resets
2020-01-12 12:21:21 +01:00
rpmsg: glink: Free pending deferred work on remove
2019-12-21 11:04:41 +01:00
rtc: sun6i: Add support for RTC clocks on R40
2020-01-14 20:08:21 +01:00
s390/qeth: don't return -ENOTSUPP to userspace
2020-01-12 12:21:44 +01:00
scsi: lpfc: Fix rpi release when deleting vport
2020-01-09 10:20:01 +01:00
soc: mediatek: cmdq: fixup wrong input order of write api
2019-12-13 08:42:40 +01:00
soundwire: intel: fix PDI/stream mapping for Bulk
2019-12-31 16:45:11 +01:00
spi: nxp-fspi: Ensure width is respected in spi-mem operations
2020-01-12 12:21:34 +01:00
staging: axis-fifo: add unspecified HAS_IOMEM dependency
2020-01-12 12:21:35 +01:00
scsi: target: iscsi: Wait for all commands to finish before freeing a session
2020-01-04 19:18:17 +01:00
thermal: Fix deadlock in thermal thermal_zone_device_check
2019-12-13 08:43:21 +01:00
thunderbolt: Power cycle the router if NVM authentication fails
2019-12-04 22:30:50 +01:00
tty: serial: msm_serial: Fix lockup for sysrq and oops
2020-01-09 10:20:05 +01:00
usb: chipidea: host: Disable port power only if previously enabled
2020-01-14 20:08:19 +01:00
vfio/pci: call irq_bypass_unregister_producer() before freeing irq
2019-12-21 11:04:48 +01:00
vhost/vsock: accept only packets with the right dst_cid
2020-01-04 19:19:18 +01:00
video/hdmi: Fix AVI bar unpack
2019-12-17 19:56:42 +01:00
virtio-balloon: fix managed page counts when migrating pages between zones
2019-12-17 19:55:56 +01:00
watchdog: tqmx86_wdt: Fix build error
2020-01-09 10:20:03 +01:00
xen/balloon: fix ballooned page accounting without hotplug enabled
2020-01-09 10:19:51 +01:00
2cc7eb6562