* [PATCH] usb: fix slab-out-of-bounds Read in cougar_report_fixup
@ 2024-07-30 23:42 Camila Alvarez
2024-07-31 19:46 ` Silvan Jegen
2024-08-01 11:04 ` Jiri Kosina
0 siblings, 2 replies; 4+ messages in thread
From: Camila Alvarez @ 2024-07-30 23:42 UTC (permalink / raw)
To: Jiri Kosina, Benjamin Tissoires
Cc: linux-input, linux-kernel, Camila Alvarez,
syzbot+24c0361074799d02c452
report_fixup for the Cougar 500k Gaming Keyboard was not verifying
that the report descriptor size was correct before accessing it
Reported-by: syzbot+24c0361074799d02c452@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452
Signed-off-by: Camila Alvarez <cam.alvarez.i@gmail.com>
---
drivers/hid/hid-cougar.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c
index cb8bd8aae15b..0fa785f52707 100644
--- a/drivers/hid/hid-cougar.c
+++ b/drivers/hid/hid-cougar.c
@@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void)
static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc,
unsigned int *rsize)
{
- if (rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
+ if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
(rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) {
hid_info(hdev,
"usage count exceeds max: fixing up report descriptor\n");
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: fix slab-out-of-bounds Read in cougar_report_fixup
2024-07-30 23:42 [PATCH] usb: fix slab-out-of-bounds Read in cougar_report_fixup Camila Alvarez
@ 2024-07-31 19:46 ` Silvan Jegen
2024-08-01 11:04 ` Jiri Kosina
1 sibling, 0 replies; 4+ messages in thread
From: Silvan Jegen @ 2024-07-31 19:46 UTC (permalink / raw)
To: Camila Alvarez
Cc: Jiri Kosina, Benjamin Tissoires, linux-input, linux-kernel,
syzbot+24c0361074799d02c452
On Tue, Jul 30, 2024 at 07:42:43PM -0400, Camila Alvarez wrote:
> report_fixup for the Cougar 500k Gaming Keyboard was not verifying
> that the report descriptor size was correct before accessing it
>
> Reported-by: syzbot+24c0361074799d02c452@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452
> Signed-off-by: Camila Alvarez <cam.alvarez.i@gmail.com>
> ---
> drivers/hid/hid-cougar.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
This LGTM!
Reviewed-by: Silvan Jegen <s.jegen@gmail.com>
>
> diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c
> index cb8bd8aae15b..0fa785f52707 100644
> --- a/drivers/hid/hid-cougar.c
> +++ b/drivers/hid/hid-cougar.c
> @@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void)
> static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc,
> unsigned int *rsize)
> {
> - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
> + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
> (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) {
> hid_info(hdev,
> "usage count exceeds max: fixing up report descriptor\n");
> --
> 2.34.1
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: fix slab-out-of-bounds Read in cougar_report_fixup
2024-07-30 23:42 [PATCH] usb: fix slab-out-of-bounds Read in cougar_report_fixup Camila Alvarez
2024-07-31 19:46 ` Silvan Jegen
@ 2024-08-01 11:04 ` Jiri Kosina
2024-08-01 15:58 ` Camila Alvarez Inostroza
1 sibling, 1 reply; 4+ messages in thread
From: Jiri Kosina @ 2024-08-01 11:04 UTC (permalink / raw)
To: Camila Alvarez
Cc: Benjamin Tissoires, linux-input, linux-kernel,
syzbot+24c0361074799d02c452
On Tue, 30 Jul 2024, Camila Alvarez wrote:
> report_fixup for the Cougar 500k Gaming Keyboard was not verifying
> that the report descriptor size was correct before accessing it
>
> Reported-by: syzbot+24c0361074799d02c452@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452
> Signed-off-by: Camila Alvarez <cam.alvarez.i@gmail.com>
Applied, thanks.
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: fix slab-out-of-bounds Read in cougar_report_fixup
2024-08-01 11:04 ` Jiri Kosina
@ 2024-08-01 15:58 ` Camila Alvarez Inostroza
0 siblings, 0 replies; 4+ messages in thread
From: Camila Alvarez Inostroza @ 2024-08-01 15:58 UTC (permalink / raw)
To: Jiri Kosina
Cc: Camila Alvarez, Benjamin Tissoires, linux-input, linux-kernel,
syzbot+24c0361074799d02c452
On Thu, 1 Aug 2024, Jiri Kosina wrote:
> On Tue, 30 Jul 2024, Camila Alvarez wrote:
>
>> report_fixup for the Cougar 500k Gaming Keyboard was not verifying
>> that the report descriptor size was correct before accessing it
>>
>> Reported-by: syzbot+24c0361074799d02c452@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452
>> Signed-off-by: Camila Alvarez <cam.alvarez.i@gmail.com>
>
> Applied, thanks.
>
Thank you!
> --
> Jiri Kosina
> SUSE Labs
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-08-01 15:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-07-30 23:42 [PATCH] usb: fix slab-out-of-bounds Read in cougar_report_fixup Camila Alvarez
2024-07-31 19:46 ` Silvan Jegen
2024-08-01 11:04 ` Jiri Kosina
2024-08-01 15:58 ` Camila Alvarez Inostroza
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).