[PATCH] HID: logitech-hidpp: fix slab-out-of-bounds write in HIDPP_FF_DESTROY_EFFECT

[Jinmo Yang <jinmo44.yang@gmail.com>]

Add a missing bounds check in hidpp_ff_work_handler() for the
HIDPP_FF_DESTROY_EFFECT case.

When erasing a force-feedback effect that was never uploaded,
hidpp_ff_find_effect() returns 0 and this value is stored in
wd->params[0].  The handler then computes effect_ids[params[0] - 1],
i.e. effect_ids[-1], which is a slab-out-of-bounds write of -1.

The symmetric HIDPP_FF_DOWNLOAD_EFFECT case already guards the access
with `slot > 0 && slot <= data->num_effects`.  Apply the same bounds
check to HIDPP_FF_DESTROY_EFFECT.

KASAN report (on 7.0.5 with raw-gadget G920 emulation):

  BUG: KASAN: slab-out-of-bounds in hidpp_ff_work_handler+0x980/0x9d0
  Write of size 4 at addr ffff888003013afc by task kworker/u8:0/12

  The buggy address belongs to the object at ffff888003013ae0
   which belongs to the cache kmalloc-16 of size 16
  The buggy address is located 12 bytes to the right of
   allocated 16-byte region [ffff888003013ae0, ffff888003013af0)

Fixes: ff21a635dd1a ("HID: logitech-hidpp: Force feedback support for the Logitech G920")
Cc: stable@vger.kernel.org
Signed-off-by: Jinmo Yang <jinmo44.yang@gmail.com>
---
 drivers/hid/hid-logitech-hidpp.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -2525,12 +2525,14 @@
 		}
 		break;
 	case HIDPP_FF_DESTROY_EFFECT:
-		if (wd->effect_id >= 0)
-			/* regular effect destroyed */
-			data->effect_ids[wd->params[0]-1] = -1;
-		else if (wd->effect_id >= HIDPP_FF_EFFECTID_AUTOCENTER)
-			/* autocenter spring destoyed */
+		if (wd->effect_id >= 0) {
+			u8 slot = wd->params[0];
+
+			if (slot > 0 && slot <= data->num_effects)
+				data->effect_ids[slot - 1] = -1;
+		} else if (wd->effect_id >= HIDPP_FF_EFFECTID_AUTOCENTER) {
 			data->slot_autocenter = 0;
+		}
 		break;
 	case HIDPP_FF_SET_GLOBAL_GAINS:
 		data->gain = (wd->params[0] << 8) + wd->params[1];
--
2.39.2