Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5d53797c authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Greg Kroah-Hartman
Browse files

Input: iforce - invert valid length check when fetching device IDs 



commit b8ebf250997c5fb253582f42bfe98673801ebebd upstream.

syzbot is reporting uninitialized value at iforce_init_device() [1], for
commit 6ac0aec6 ("Input: iforce - allow callers supply data buffer
when fetching device IDs") is checking that valid length is shorter than
bytes to read. Since iforce_get_id_packet() stores valid length when
returning 0, the caller needs to check that valid length is longer than or
equals to bytes to read.

Reported-by: default avatarsyzbot <syzbot+4dd880c1184280378821@syzkaller.appspotmail.com>
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6ac0aec6 ("Input: iforce - allow callers supply data buffer when fetching device IDs")
Link: https://lore.kernel.org/r/531fb432-7396-ad37-ecba-3e42e7f56d5c@I-love.SAKURA.ne.jp


Cc: stable@vger.kernel.org
Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 89c0c27a

drivers/input/joystick/iforce/iforce-main.c

+4 −4
Original line number Diff line number Diff line
@@ -273,22 +273,22 @@ int iforce_init_device(struct device *parent, u16 bustype, 
 * Get device info.

 */



	if (!iforce_get_id_packet(iforce, 'M', buf, &len) || len < 3)

	if (!iforce_get_id_packet(iforce, 'M', buf, &len) && len >= 3)

		input_dev->id.vendor = get_unaligned_le16(buf + 1);

	else

		dev_warn(&iforce->dev->dev, "Device does not respond to id packet M\n");



	if (!iforce_get_id_packet(iforce, 'P', buf, &len) || len < 3)

	if (!iforce_get_id_packet(iforce, 'P', buf, &len) && len >= 3)

		input_dev->id.product = get_unaligned_le16(buf + 1);

	else

		dev_warn(&iforce->dev->dev, "Device does not respond to id packet P\n");



	if (!iforce_get_id_packet(iforce, 'B', buf, &len) || len < 3)

	if (!iforce_get_id_packet(iforce, 'B', buf, &len) && len >= 3)

		iforce->device_memory.end = get_unaligned_le16(buf + 1);

	else

		dev_warn(&iforce->dev->dev, "Device does not respond to id packet B\n");



	if (!iforce_get_id_packet(iforce, 'N', buf, &len) || len < 2)

	if (!iforce_get_id_packet(iforce, 'N', buf, &len) && len >= 2)

		ff_effects = buf[1];

	else

		dev_warn(&iforce->dev->dev, "Device does not respond to id packet N\n");