Signed-off-by: Rafi Rubin <rafi@xxxxxxxxxxxxxx> Thanks Kees, Rafi On 08/28/13 16:31, Jiri Kosina wrote: > From: Kees Cook <keescook@xxxxxxxxxxxx> > > A HID device could send a malicious feature report that would cause the > ntrig HID driver to trigger a NULL dereference during initialization: > > [57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001 > ... > [57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 > [57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig] > > CVE-2013-2896 > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > Cc: stable@xxxxxxxxxx > --- > drivers/hid/hid-ntrig.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c > index ef95102..5482156 100644 > --- a/drivers/hid/hid-ntrig.c > +++ b/drivers/hid/hid-ntrig.c > @@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev) > struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT]. > report_id_hash[0x0d]; > > - if (!report) > + if (!report || report->maxfield < 1 || > + report->field[0]->report_count < 1) > return -EINVAL; > > hid_hw_request(hdev, report, HID_REQ_GET_REPORT); > -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
