This is a note to let you know that I've just added the patch titled
HID: hid-cypress: validate length of report
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
hid-hid-cypress-validate-length-of-report.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 1ebb71143758f45dc0fa76e2f48429e13b16d110 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 6 Jan 2017 15:33:36 +0100
Subject: HID: hid-cypress: validate length of report
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
commit 1ebb71143758f45dc0fa76e2f48429e13b16d110 upstream.
Make sure we have enough of a report structure to validate before
looking at it.
Reported-by: Benoit Camredon <benoit.camredon@xxxxxxxxxx>
Tested-by: Benoit Camredon <benoit.camredon@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Jiri Kosina <jkosina@xxxxxxx>
---
drivers/hid/hid-cypress.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-cypress.c
+++ b/drivers/hid/hid-cypress.c
@@ -39,6 +39,9 @@ static __u8 *cp_report_fixup(struct hid_
if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
return rdesc;
+ if (*rsize < 4)
+ return rdesc;
+
for (i = 0; i < *rsize - 4; i++)
if (rdesc[i] == 0x29 && rdesc[i + 2] == 0x19) {
rdesc[i] = 0x19;
Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are
queue-4.4/net-vrf-drop-conntrack-data-after-pass-through-vrf-device-on-tx.patch
queue-4.4/gro-disable-frag0-optimization-on-ipv6-ext-headers.patch
queue-4.4/net-mlx5-check-fw-limitations-on-log_max_qp-before-setting-it.patch
queue-4.4/net-sched-fix-soft-lockup-in-tc_classify.patch
queue-4.4/net-ipv4-fix-multipath-selection-with-vrf.patch
queue-4.4/ipv4-do-not-allow-main-to-be-alias-for-new-local-w-custom-rules.patch
queue-4.4/net-mlx5-avoid-shadowing-numa_node.patch
queue-4.4/spi-mvebu-fix-baudrate-calculation-for-armada-variant.patch
queue-4.4/powerpc-fix-build-warning-on-32-bit-ppc.patch
queue-4.4/r8152-split-rtl8152_suspend-function.patch
queue-4.4/ipv6-handle-efault-from-skb_copy_bits.patch
queue-4.4/drop_monitor-add-missing-call-to-genlmsg_end.patch
queue-4.4/hid-hid-cypress-validate-length-of-report.patch
queue-4.4/net-vrf-do-not-allow-table-id-0.patch
queue-4.4/gro-use-min_t-in-skb_gro_reset_offset.patch
queue-4.4/drop_monitor-consider-inserted-data-in-genlmsg_end.patch
queue-4.4/alsa-firewire-tascam-fix-to-handle-error-from-initialization-of-stream-data.patch
queue-4.4/netvsc-reduce-maximum-gso-size.patch
queue-4.4/r8152-fix-rx-issue-for-runtime-suspend.patch
queue-4.4/arm-zynq-reserve-correct-amount-of-non-dma-ram.patch
queue-4.4/net-stmmac-fix-race-between-stmmac_drv_probe-and-stmmac_open.patch
queue-4.4/arm-omap4-fix-bad-fallthrough-for-cpuidle.patch
queue-4.4/gro-enter-slow-path-if-there-is-no-tailroom.patch
queue-4.4/ser_gigaset-return-enomem-on-error-instead-of-success.patch
queue-4.4/igmp-make-igmp-group-member-rfc-3376-compliant.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html