[PATCH 0/8] HID: validate report size in raw_event callbacks

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

Several HID drivers access report data at fixed offsets in their
raw_event callbacks without checking that the buffer is large enough.

Since hid-core invokes each driver's raw_event callback before it
validates the report length in hid_report_raw_event(), these drivers
must perform their own bounds checking to handle short reports safely.

This series adds size validation to eight drivers:
 - pxrc, cougar, zydacron, mcp2200, prodikeys: simple minimum size
 - alps: per-report-type validation (touchpad, stick, absolute)
 - oxp: per-report-type struct size validation
 - cp2112: size checks for transfer status and data read responses,
   plus capping the read copy length to the available buffer

Tristan Madani (8):
  HID: pxrc: validate report size in raw_event callback
  HID: alps: validate report size in raw_event callbacks
  HID: mcp2200: validate report size in raw_event callback
  HID: cougar: validate report size in raw_event callback
  HID: zydacron: validate report size in raw_event callback
  HID: oxp: validate report size in raw_event callbacks
  HID: cp2112: validate report size in raw_event callback
  HID: prodikeys: validate report size in raw_event callback

 drivers/hid/hid-alps.c      | 12 ++++++++++++
 drivers/hid/hid-cougar.c    |  3 +++
 drivers/hid/hid-cp2112.c    | 10 ++++++++++
 drivers/hid/hid-mcp2200.c   |  3 +++
 drivers/hid/hid-oxp.c       |  6 ++++++
 drivers/hid/hid-prodikeys.c |  3 +++
 drivers/hid/hid-pxrc.c      |  3 +++
 drivers/hid/hid-zydacron.c  |  3 +++
 8 files changed, 43 insertions(+)

-- 
2.47.3