lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event

Browse Source 
[ Upstream commit ffe3b7837a2bb421df84d0177481db9f52c93a71 ]

There is a slab-out-of-bounds Write bug in hid-holtek-kbd driver.
The problem is the driver assumes the device must have an input
but some malicious devices violate this assumption.

Fix this by checking hid_device's input is non-empty before its usage.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Ma Ke 2023-09-18 10:40:59 +08:00 committed by Greg Kroah-Hartman
parent 981dfec995
commit fa83d852e9
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/hid/hid-holtek-kbd.c
View File

@ -130,6 +130,10 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
return -ENODEV; return -ENODEV;
boot_hid = usb_get_intfdata(boot_interface); boot_hid = usb_get_intfdata(boot_interface);
if (list_empty(&boot_hid->inputs)) {
hid_err(hid, "no inputs found\n");
return -ENODEV;
}
boot_hid_input = list_first_entry(&boot_hid->inputs, boot_hid_input = list_first_entry(&boot_hid->inputs,
struct hid_input, list); struct hid_input, list);