Re: [PATCH] HID: pidff: validate effect type usage indexes

[sashiko-bot@kernel.org]

> pidff_find_special_keys() records usage positions as one-based values, but
> pidff_find_effects() uses those values directly as array indexes.  The
> Create New Effect and Set Effect fields are independently allocated and
> need not have the same number of usages, so a malformed descriptor can
> make the lookup leave the Set Effect usage array.
> 
> KASAN reports:
> 
>   BUG: KASAN: slab-out-of-bounds in hid_pidff_init_with_quirks
>   Read of size 4
>   hid_pidff_init_with_quirks
>   universal_pidff_probe
>   hid_device_probe
>   uhid_device_add_worker
> 
> Convert the stored position back to a zero-based index and validate it
> against both fields before comparing the usages.
> 
> The reproducer is rejected without a KASAN report with this change.
> 
> Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices")
> Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179362071771.29269.11607321878213733518@stu.pku.edu.cn?part=1