Re: [PATCH 5.4 17/78] HID: Fix slab-out-of-bounds read in hid_field_extract (Broken!)

Enderborg, Peter
2020-02-06T07:01:00Z

On 2/5/20 4:00 PM, Alan Stern wrote:
> On Wed, 5 Feb 2020, Jiri Kosina wrote:
>
>> On Wed, 5 Feb 2020, Enderborg, Peter wrote:
>>
>>>>> This patch breaks Elgato StreamDeck.
>>>> Does that mean the device is broken with a too-large of a report?
>>> Yes.
>> In which way does the breakage pop up? Are you getting "report too long"
>> errors in dmesg, or the device just doesn't enumerate at all?
>>
>> Could you please post /sys/kernel/debug/hid/<device>/rdesc contents, and
>> if the device is at least semi-alive, also contents of
>> /sys/kernel/debug/hid/<device>/events from the time it misbehaves?
> Also, please post the output from "lsusb -v" for the StreamDeck.

Bus 002 Device 008: ID 0fd9:0060 Elgato Systems GmbH Stream Deck
Device Descriptor:
bLength                18
bDescriptorType         1
bcdUSB               2.00
bDeviceClass            0
bDeviceSubClass         0
bDeviceProtocol         0
bMaxPacketSize0        64
idVendor           0x0fd9 Elgato Systems GmbH
idProduct          0x0060
bcdDevice            1.00
iManufacturer           1
iProduct                2
iSerial                 3
bNumConfigurations      1
Configuration Descriptor:
bLength                 9
bDescriptorType         2
wTotalLength       0x0029
bNumInterfaces          1
bConfigurationValue     1
iConfiguration          0
bmAttributes         0xe0
Self Powered
Remote Wakeup
MaxPower              400mA
Interface Descriptor:
bLength                 9
bDescriptorType         4
bInterfaceNumber        0
bAlternateSetting       0
bNumEndpoints           2
bInterfaceClass         3 Human Interface Device
bInterfaceSubClass      0
bInterfaceProtocol      0
iInterface              0
HID Device Descriptor:
bLength                 9
bDescriptorType        33
bcdHID               1.11
bCountryCode            0 Not supported
bNumDescriptors         1
bDescriptorType        34 Report
wDescriptorLength     248
Report Descriptors:
** UNAVAILABLE **
Endpoint Descriptor:
bLength                 7
bDescriptorType         5
bEndpointAddress     0x81  EP 1 IN
bmAttributes            3
Transfer Type            Interrupt
Synch Type               None
Usage Type               Data
wMaxPacketSize     0x0200  1x 512 bytes
bInterval               1
Endpoint Descriptor:
bLength                 7
bDescriptorType         5
bEndpointAddress     0x02  EP 2 OUT
bmAttributes            3
Transfer Type            Interrupt
Synch Type               None
Usage Type               Data
wMaxPacketSize     0x0200  1x 512 bytes
bInterval               1

> Alan Stern
>