lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report

Browse Source 
commit cd11d1a6114bd4bc6450ae59f6e110ec47362126 upstream.

It is possible for a malicious device to forgo submitting a Feature
Report.  The HID Steam driver presently makes no prevision for this
and de-references the 'struct hid_report' pointer obtained from the
HID devices without first checking its validity.  Let's change that.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Fixes: c164d6abf3 ("HID: add driver for Valve Steam Controller")
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Lee Jones 2022-07-08 08:40:09 +01:00 committed by Greg Kroah-Hartman
parent 6551fbe258
commit fa2b822d86
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/hid/hid-steam.c
View File

@ -134,6 +134,11 @@ static int steam_recv_report(struct steam_device *steam,
int ret; int ret;
r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0]; r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
if (!r) {
hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n");
return -EINVAL;
}
if (hid_report_len(r) < 64) if (hid_report_len(r) < 64)
return -EINVAL; return -EINVAL;
@ -165,6 +170,11 @@ static int steam_send_report(struct steam_device *steam,
int ret; int ret;
r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0]; r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
if (!r) {
hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n");
return -EINVAL;
}
if (hid_report_len(r) < 64) if (hid_report_len(r) < 64)
return -EINVAL; return -EINVAL;