Patch "HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hid-cougar-fix-slab-out-of-bounds-read-in-cougar_rep.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 24d17d1dc590adfda223967dd8bf3e7904c4ac8e
Author: Camila Alvarez <cam.alvarez.i@xxxxxxxxx>
Date:   Tue Jul 30 19:42:43 2024 -0400

    HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
    
    [ Upstream commit a6e9c391d45b5865b61e569146304cff72821a5d ]
    
    report_fixup for the Cougar 500k Gaming Keyboard was not verifying
    that the report descriptor size was correct before accessing it
    
    Reported-by: syzbot+24c0361074799d02c452@xxxxxxxxxxxxxxxxxxxxxxxxx
    Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452
    Signed-off-by: Camila Alvarez <cam.alvarez.i@xxxxxxxxx>
    Reviewed-by: Silvan Jegen <s.jegen@xxxxxxxxx>
    Signed-off-by: Jiri Kosina <jkosina@xxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c
index ad2e87de7dc5..d58a108a96c0 100644
--- a/drivers/hid/hid-cougar.c
+++ b/drivers/hid/hid-cougar.c
@@ -104,7 +104,7 @@ static void cougar_fix_g6_mapping(struct hid_device *hdev)
 static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 				 unsigned int *rsize)
 {
-	if (rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
+	if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
 	    (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) {
 		hid_info(hdev,
 			"usage count exceeds max: fixing up report descriptor\n");




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux