Patch "HID: hid-cypress: validate length of report" has been added to the 4.9-stable tree

[<gregkh@linuxfoundation.org>]

This is a note to let you know that I've just added the patch titled

    HID: hid-cypress: validate length of report

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hid-hid-cypress-validate-length-of-report.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 1ebb71143758f45dc0fa76e2f48429e13b16d110 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 6 Jan 2017 15:33:36 +0100
Subject: HID: hid-cypress: validate length of report

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1ebb71143758f45dc0fa76e2f48429e13b16d110 upstream.

Make sure we have enough of a report structure to validate before
looking at it.

Reported-by: Benoit Camredon <benoit.camredon@airbus.com>
Tested-by: Benoit Camredon <benoit.camredon@airbus.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

---
 drivers/hid/hid-cypress.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/hid/hid-cypress.c
+++ b/drivers/hid/hid-cypress.c
@@ -39,6 +39,9 @@ static __u8 *cp_report_fixup(struct hid_
 	if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
 		return rdesc;
 
+	if (*rsize < 4)
+		return rdesc;
+
 	for (i = 0; i < *rsize - 4; i++)
 		if (rdesc[i] == 0x29 && rdesc[i + 2] == 0x19) {
 			rdesc[i] = 0x19;


Patches currently in stable-queue which might be from gregkh@linuxfoundation.org are

queue-4.9/bpf-change-back-to-orig-prog-on-too-many-passes.patch
queue-4.9/inet-fix-ip-v6-_recvorigdstaddr-for-udp-sockets.patch
queue-4.9/net-mlx5e-don-t-sync-netdev-state-when-not-registered.patch
queue-4.9/net-vrf-drop-conntrack-data-after-pass-through-vrf-device-on-tx.patch
queue-4.9/gro-disable-frag0-optimization-on-ipv6-ext-headers.patch
queue-4.9/net-mlx5-mask-destination-mac-value-in-ethtool-steering-rules.patch
queue-4.9/net-add-the-af_qipcrtr-entries-to-family-name-tables.patch
queue-4.9/net-mlx5-check-fw-limitations-on-log_max_qp-before-setting-it.patch
queue-4.9/net-sched-fix-soft-lockup-in-tc_classify.patch
queue-4.9/arm-8631-1-clkdev-detect-errors-in-clk_hw_register_clkdev-for-mass-registration.patch
queue-4.9/sctp-sctp_transport_lookup_process-should-rcu_read_unlock-when-transport-is-null.patch
queue-4.9/net-sched-cls_flower-fix-missing-addr_type-in-classify.patch
queue-4.9/net-ipv4-fix-multipath-selection-with-vrf.patch
queue-4.9/svcrdma-clear-xpt_bc_xps-in-xprt_setup_rdma_bc-error-exit-arm.patch
queue-4.9/arm-omap2-am437x-rollback-to-use-omap3_gptimer_timer_init.patch
queue-4.9/arm-omap5-fix-build-for-pm-code.patch
queue-4.9/ipv4-do-not-allow-main-to-be-alias-for-new-local-w-custom-rules.patch
queue-4.9/arm64-dts-bcm2837-rpi-3-b-remove-incorrect-pwr-led.patch
queue-4.9/tools-virtio-fix-read_once.patch
queue-4.9/net-mlx5-avoid-shadowing-numa_node.patch
queue-4.9/net-ipv4-dst-for-local-input-routes-should-use-l3mdev-if-relevant.patch
queue-4.9/spi-mvebu-fix-baudrate-calculation-for-armada-variant.patch
queue-4.9/net-mlx5e-disable-netdev-after-close.patch
queue-4.9/powerpc-fix-build-warning-on-32-bit-ppc.patch
queue-4.9/r8152-split-rtl8152_suspend-function.patch
queue-4.9/arm64-dts-bcm2835-fix-bcm2837-compatible-string.patch
queue-4.9/ipv6-handle-efault-from-skb_copy_bits.patch
queue-4.9/net-vrf-add-missing-rx-counters.patch
queue-4.9/drop_monitor-add-missing-call-to-genlmsg_end.patch
queue-4.9/arm64-dts-mt8173-fix-auxadc-node.patch
queue-4.9/hid-hid-cypress-validate-length-of-report.patch
queue-4.9/net-vrf-do-not-allow-table-id-0.patch
queue-4.9/gro-use-min_t-in-skb_gro_reset_offset.patch
queue-4.9/drop_monitor-consider-inserted-data-in-genlmsg_end.patch
queue-4.9/alsa-firewire-tascam-fix-to-handle-error-from-initialization-of-stream-data.patch
queue-4.9/arm-qcom_defconfig-fix-mdm9515-lcc-and-gcc-config.patch
queue-4.9/rtnl-stats-add-missing-netlink-message-size-checks.patch
queue-4.9/arm-pxa-fix-pxa25x-interrupt-init.patch
queue-4.9/net-mlx5e-remove-warn_once-from-adaptive-moderation-code.patch
queue-4.9/bus-arm-ccn-prevent-hotplug-callback-leak.patch
queue-4.9/net-dsa-ensure-validity-of-dst-ds.patch
queue-4.9/r8152-fix-rx-issue-for-runtime-suspend.patch
queue-4.9/net-mlx5-prevent-setting-multicast-macs-for-vfs.patch
queue-4.9/net-vrf-fix-nat-within-a-vrf.patch
queue-4.9/arm-zynq-reserve-correct-amount-of-non-dma-ram.patch
queue-4.9/net-mlx5-cancel-recovery-work-in-remove-flow.patch
queue-4.9/net-fix-incorrect-original-ingress-device-index-in-pktinfo.patch
queue-4.9/net-stmmac-fix-race-between-stmmac_drv_probe-and-stmmac_open.patch
queue-4.9/arm-omap4-fix-bad-fallthrough-for-cpuidle.patch
queue-4.9/net-dsa-bcm_sf2-utilize-nested-mdio-read-write.patch
queue-4.9/arm-omap5-fix-mpuss_early_init.patch
queue-4.9/net-dsa-bcm_sf2-do-not-clobber-b53_switch_ops.patch
queue-4.9/gro-enter-slow-path-if-there-is-no-tailroom.patch
queue-4.9/flow_dissector-update-pptp-handling-to-avoid-null-pointer-deref.patch
queue-4.9/igmp-make-igmp-group-member-rfc-3376-compliant.patch