From: Zefan Li <lizf@kernel.org>
To: stable@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, Jiri Kosina <jkosina@suse.cz>,
Zefan Li <lizefan@huawei.com>
Subject: [PATCH 3.4 04/45] HID: fix a couple of off-by-ones
Date: Tue, 23 Sep 2014 10:31:06 +0800 [thread overview]
Message-ID: <1411439507-30391-4-git-send-email-lizf@kernel.org> (raw)
In-Reply-To: <1411439259-30224-1-git-send-email-lizf@kernel.org>
From: Jiri Kosina <jkosina@suse.cz>
3.4.104-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 4ab25786c87eb20857bbb715c3ae34ec8fd6a214 upstream.
There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/hid/hid-cherry.c | 2 +-
drivers/hid/hid-kye.c | 2 +-
drivers/hid/hid-lg.c | 4 ++--
drivers/hid/hid-monterey.c | 2 +-
drivers/hid/hid-petalynx.c | 2 +-
drivers/hid/hid-sunplus.c | 2 +-
6 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
index 888ece6..f870bb3 100644
--- a/drivers/hid/hid-cherry.c
+++ b/drivers/hid/hid-cherry.c
@@ -29,7 +29,7 @@
static __u8 *ch_report_fixup(struct hid_device *hdev, __u8 *rdesc,
unsigned int *rsize)
{
- if (*rsize >= 17 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
+ if (*rsize >= 18 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
hid_info(hdev, "fixing up Cherry Cymotion report descriptor\n");
rdesc[11] = rdesc[16] = 0xff;
rdesc[12] = rdesc[17] = 0x03;
diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
index b4f0d82..d7118f8 100644
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -282,7 +282,7 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
* - change the button usage range to 4-7 for the extra
* buttons
*/
- if (*rsize >= 74 &&
+ if (*rsize >= 75 &&
rdesc[61] == 0x05 && rdesc[62] == 0x08 &&
rdesc[63] == 0x19 && rdesc[64] == 0x08 &&
rdesc[65] == 0x29 && rdesc[66] == 0x0f &&
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index e7a7bd1..cb01e67 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -111,7 +111,7 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
{
unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
- if ((quirks & LG_RDESC) && *rsize >= 90 && rdesc[83] == 0x26 &&
+ if ((quirks & LG_RDESC) && *rsize >= 91 && rdesc[83] == 0x26 &&
rdesc[84] == 0x8c && rdesc[85] == 0x02) {
hid_info(hdev,
"fixing up Logitech keyboard report descriptor\n");
@@ -120,7 +120,7 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
}
if ((quirks & LG_RDESC_REL_ABS) && *rsize >= 50 &&
rdesc[32] == 0x81 && rdesc[33] == 0x06 &&
- rdesc[49] == 0x81 && rdesc[50] == 0x06) {
+ rdesc[49] == 0x81 && rdesc[51] == 0x06) {
hid_info(hdev,
"fixing up rel/abs in Logitech report descriptor\n");
rdesc[33] = rdesc[50] = 0x02;
diff --git a/drivers/hid/hid-monterey.c b/drivers/hid/hid-monterey.c
index dedf757..eb0271e 100644
--- a/drivers/hid/hid-monterey.c
+++ b/drivers/hid/hid-monterey.c
@@ -25,7 +25,7 @@
static __u8 *mr_report_fixup(struct hid_device *hdev, __u8 *rdesc,
unsigned int *rsize)
{
- if (*rsize >= 30 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
+ if (*rsize >= 31 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
hid_info(hdev, "fixing up button/consumer in HID report descriptor\n");
rdesc[30] = 0x0c;
}
diff --git a/drivers/hid/hid-petalynx.c b/drivers/hid/hid-petalynx.c
index f1ea3ff..99f317a 100644
--- a/drivers/hid/hid-petalynx.c
+++ b/drivers/hid/hid-petalynx.c
@@ -26,7 +26,7 @@
static __u8 *pl_report_fixup(struct hid_device *hdev, __u8 *rdesc,
unsigned int *rsize)
{
- if (*rsize >= 60 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
+ if (*rsize >= 62 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
rdesc[41] == 0x00 && rdesc[59] == 0x26 &&
rdesc[60] == 0xf9 && rdesc[61] == 0x00) {
hid_info(hdev, "fixing up Petalynx Maxter Remote report descriptor\n");
diff --git a/drivers/hid/hid-sunplus.c b/drivers/hid/hid-sunplus.c
index d484a00..3d6ae7b 100644
--- a/drivers/hid/hid-sunplus.c
+++ b/drivers/hid/hid-sunplus.c
@@ -25,7 +25,7 @@
static __u8 *sp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
unsigned int *rsize)
{
- if (*rsize >= 107 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
+ if (*rsize >= 112 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
rdesc[106] == 0x03) {
hid_info(hdev, "fixing up Sunplus Wireless Desktop report descriptor\n");
rdesc[105] = rdesc[110] = 0x03;
--
1.7.9.5
next prev parent reply other threads:[~2014-09-23 2:34 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-09-23 2:27 [PATCH 3.4 00/45] 3.4.104-rc1 review Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 01/45] stable_kernel_rules: Add pointer to netdev-FAQ for network patches Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 02/45] ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 03/45] ibmveth: Fix endian issues with rx_no_buffer statistic Zefan Li
2014-09-23 2:31 ` Zefan Li [this message]
2014-09-23 2:31 ` [PATCH 3.4 05/45] HID: logitech: perform bounds checking on device_id early enough Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 06/45] isofs: Fix unbounded recursion when processing relocated directories Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 07/45] MIPS: OCTEON: make get_system_type() thread-safe Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 08/45] kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601) Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 09/45] pata_scc: propagate return value of scc_wait_after_reset Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 10/45] iommu/amd: Fix cleanup_domain for mass device removal Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 11/45] md/raid6: avoid data corruption during recovery of double-degraded RAID6 Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 12/45] CIFS: Fix wrong directory attributes after rename Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 13/45] ALSA: hda/realtek - Avoid setting wrong COEF on ALC269 & co Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 14/45] xtensa: replace IOCTL code definitions with constants Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 15/45] xtensa: fix address checks in dma_{alloc,free}_coherent Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 16/45] xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 17/45] xtensa: fix a6 and a7 handling in fast_syscall_xtensa Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 18/45] staging: et131x: Fix errors caused by phydev->addr accesses before initialisation Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 19/45] USB: option: add VIA Telecom CDS7 chipset device id Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 20/45] USB: ftdi_sio: add Basic Micro ATOM Nano USB2Serial PID Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 21/45] USB: serial: pl2303: add device id for ztek device Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 22/45] USB: ftdi_sio: Added PID for new ekey device Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 23/45] xhci: Treat not finding the event_seg on COMP_STOP the same as COMP_STOP_INVAL Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 24/45] usb: xhci: amd chipset also needs short TX quirk Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 25/45] USB: whiteheat: Added bounds checking for bulk command response Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 26/45] HID: logitech-dj: prevent false errors to be shown Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 27/45] USB: sisusb: add device id for Magic Control USB video Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 28/45] NFSv4: Fix problems with close in the presence of a delegation Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 29/45] HID: magicmouse: sanity check report size in raw_event() callback Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 30/45] HID: picolcd: " Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 31/45] ARM: 8128/1: abort: don't clear the exclusive monitors Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 32/45] ARM: 8129/1: errata: work around Cortex-A15 erratum 830321 using dummy strex Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 33/45] USB: serial: fix potential stack buffer overflow Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 34/45] USB: serial: fix potential heap " Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 35/45] MIPS: perf: Fix build error caused by unused counters_per_cpu_to_total() Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 36/45] MIPS: Fix accessing to per-cpu data when flushing the cache Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 37/45] openrisc: add missing header inclusion Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 38/45] slab/mempolicy: always use local policy from interrupt context Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 39/45] 8250_pci: fix warnings in backport of Broadcom TruManage support Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 40/45] unicore32: select generic atomic64_t support Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 41/45] UniCore32-bugfix: Remove definitions in asm/bug.h to solve difference between native and cross compiler Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 42/45] UniCore32-bugfix: fix mismatch return value of __xchg_bad_pointer Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 43/45] alpha: Fix fall-out from disintegrating asm/system.h Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 44/45] ext2: Fix fs corruption in ext2_get_xip_mem() Zefan Li
2014-09-23 2:31 ` [PATCH 3.4 45/45] alpha: add io{read,write}{16,32}be functions Zefan Li
2014-09-23 2:42 ` [PATCH 3.4 00/45] 3.4.104-rc1 review Guenter Roeck
2014-09-23 2:54 ` Guenter Roeck
2014-09-23 2:54 ` Zefan Li
2014-09-23 2:56 ` Zefan Li
2014-09-23 4:54 ` Satoru Takeuchi
2014-09-23 6:12 ` Zefan Li
2014-09-23 4:58 ` Guenter Roeck
2014-09-23 6:14 ` Zefan Li
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1411439507-30391-4-git-send-email-lizf@kernel.org \
--to=lizf@kernel.org \
--cc=jkosina@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=lizefan@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox