On Tue, Sep 01, 2020 at 09:12:09PM +0200, Pavel Machek wrote: > Hi! > > > commit 25a097f5204675550afb879ee18238ca917cba7a upstream. > > > > `uref->usage_index` is not always being properly checked, causing > > hiddev_ioctl_usage() to go out of bounds under some cases. Fix it. > > Well, the code is quite confusig, but: > > a) does HIDIOCGCOLLECTIONINDEX need same checking? It's checked in the previous switch statement. > > b) should we check this using some kind of _nospec() variant to > prevent speculation attacks? I don't think so. I wrote up an explanation earlier just because the code was so confusing. https://lkml.org/lkml/2020/7/20/523 regards, dan carpenter
