Commit a9856853 authored Sep 18, 2023 by Ma Ke Committed by Greg Kroah-Hartman Oct 25, 2023

HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event



[ Upstream commit ffe3b7837a2bb421df84d0177481db9f52c93a71 ]

There is a slab-out-of-bounds Write bug in hid-holtek-kbd driver.
The problem is the driver assumes the device must have an input
but some malicious devices violate this assumption.

Fix this by checking hid_device's input is non-empty before its usage.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 79700b56

drivers/hid/hid-holtek-kbd.c

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -133,6 +133,10 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
	return -ENODEV;		return -ENODEV;

	boot_hid = usb_get_intfdata(boot_interface);		boot_hid = usb_get_intfdata(boot_interface);
			if (list_empty(&boot_hid->inputs)) {
			hid_err(hid, "no inputs found\n");
			return -ENODEV;
			}
	boot_hid_input = list_first_entry(&boot_hid->inputs,		boot_hid_input = list_first_entry(&boot_hid->inputs,
	struct hid_input, list);		struct hid_input, list);