Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fac3cb3c authored by Camila Alvarez's avatar Camila Alvarez Committed by Greg Kroah-Hartman
Browse files

HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup 



[ Upstream commit a6e9c391d45b5865b61e569146304cff72821a5d ]

report_fixup for the Cougar 500k Gaming Keyboard was not verifying
that the report descriptor size was correct before accessing it

Reported-by: default avatar <syzbot+24c0361074799d02c452@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452


Signed-off-by: default avatarCamila Alvarez <cam.alvarez.i@gmail.com>
Reviewed-by: default avatarSilvan Jegen <s.jegen@gmail.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 7ef29fad

drivers/hid/hid-cougar.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void) 
static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc,

static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc,

				 unsigned int *rsize)

				 unsigned int *rsize)

{

{

	if (rdesc[2] == 0x09 && rdesc[3] == 0x02 &&

	if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 &&

	    (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) {

	    (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) {

		hid_info(hdev,

		hid_info(hdev,

			"usage count exceeds max: fixing up report descriptor\n");

			"usage count exceeds max: fixing up report descriptor\n");