Patch "HID: hid-cypress: validate length of report" has been added to the 4.4-stable tree

Patch "HID: hid-cypress: validate length of report" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    HID: hid-cypress: validate length of report

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hid-hid-cypress-validate-length-of-report.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 1ebb71143758f45dc0fa76e2f48429e13b16d110 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 6 Jan 2017 15:33:36 +0100
Subject: HID: hid-cypress: validate length of report

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1ebb71143758f45dc0fa76e2f48429e13b16d110 upstream.

Make sure we have enough of a report structure to validate before
looking at it.

Reported-by: Benoit Camredon <benoit.camredon@airbus.com>
Tested-by: Benoit Camredon <benoit.camredon@airbus.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

---
 drivers/hid/hid-cypress.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/hid/hid-cypress.c
+++ b/drivers/hid/hid-cypress.c
@@ -39,6 +39,9 @@ static __u8 *cp_report_fixup(struct hid_
 	if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
 		return rdesc;
 
+	if (*rsize < 4)
+		return rdesc;
+
 	for (i = 0; i < *rsize - 4; i++)
 		if (rdesc[i] == 0x29 && rdesc[i + 2] == 0x19) {
 			rdesc[i] = 0x19;


Patches currently in stable-queue which might be from gregkh@linuxfoundation.org are

queue-4.4/net-vrf-drop-conntrack-data-after-pass-through-vrf-device-on-tx.patch
queue-4.4/gro-disable-frag0-optimization-on-ipv6-ext-headers.patch
queue-4.4/net-mlx5-check-fw-limitations-on-log_max_qp-before-setting-it.patch
queue-4.4/net-sched-fix-soft-lockup-in-tc_classify.patch
queue-4.4/net-ipv4-fix-multipath-selection-with-vrf.patch
queue-4.4/ipv4-do-not-allow-main-to-be-alias-for-new-local-w-custom-rules.patch
queue-4.4/net-mlx5-avoid-shadowing-numa_node.patch
queue-4.4/spi-mvebu-fix-baudrate-calculation-for-armada-variant.patch
queue-4.4/powerpc-fix-build-warning-on-32-bit-ppc.patch
queue-4.4/r8152-split-rtl8152_suspend-function.patch
queue-4.4/ipv6-handle-efault-from-skb_copy_bits.patch
queue-4.4/drop_monitor-add-missing-call-to-genlmsg_end.patch
queue-4.4/hid-hid-cypress-validate-length-of-report.patch
queue-4.4/net-vrf-do-not-allow-table-id-0.patch
queue-4.4/gro-use-min_t-in-skb_gro_reset_offset.patch
queue-4.4/drop_monitor-consider-inserted-data-in-genlmsg_end.patch
queue-4.4/alsa-firewire-tascam-fix-to-handle-error-from-initialization-of-stream-data.patch
queue-4.4/netvsc-reduce-maximum-gso-size.patch
queue-4.4/r8152-fix-rx-issue-for-runtime-suspend.patch
queue-4.4/arm-zynq-reserve-correct-amount-of-non-dma-ram.patch
queue-4.4/net-stmmac-fix-race-between-stmmac_drv_probe-and-stmmac_open.patch
queue-4.4/arm-omap4-fix-bad-fallthrough-for-cpuidle.patch
queue-4.4/gro-enter-slow-path-if-there-is-no-tailroom.patch
queue-4.4/ser_gigaset-return-enomem-on-error-instead-of-success.patch
queue-4.4/igmp-make-igmp-group-member-rfc-3376-compliant.patch