Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bdf78f31 authored by Marc Zyngier's avatar Marc Zyngier Committed by Todd Kjos
Browse files

UPSTREAM: HID: core: Sanitize event code and type when mapping input



commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream.

When calling into hid_map_usage(), the passed event code is
blindly stored as is, even if it doesn't fit in the associated bitmap.

This event code can come from a variety of sources, including devices
masquerading as input devices, only a bit more "programmable".

Instead of taking the event code at face value, check that it actually
fits the corresponding bitmap, and if it doesn't:
- spit out a warning so that we know which device is acting up
- NULLify the bitmap pointer so that we catch unexpected uses

Code paths that can make use of untrusted inputs can now check
that the mapping was indeed correct and bail out if not.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Signed-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25)
Change-Id: Ie4dc11f43ed1eae2d09feaf9cff17d6d16cf9987
Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
parent cd029936
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment