Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ab25786 authored Aug 21, 2014 by Jiri Kosina

HID: fix a couple of off-by-ones



There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.

Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

parent ad3e14d7

drivers/hid/hid-cherry.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -28,7 +28,7 @@
	static __u8 ch_report_fixup(struct hid_device hdev, __u8 *rdesc,		static __u8 ch_report_fixup(struct hid_device hdev, __u8 *rdesc,
	unsigned int *rsize)		unsigned int *rsize)
	{		{
	if (*rsize >= 17 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {		if (*rsize >= 18 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
	hid_info(hdev, "fixing up Cherry Cymotion report descriptor\n");		hid_info(hdev, "fixing up Cherry Cymotion report descriptor\n");
	rdesc[11] = rdesc[16] = 0xff;		rdesc[11] = rdesc[16] = 0xff;
	rdesc[12] = rdesc[17] = 0x03;		rdesc[12] = rdesc[17] = 0x03;

drivers/hid/hid-kye.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -300,7 +300,7 @@ static __u8 kye_report_fixup(struct hid_device hdev, __u8 *rdesc,
	* - change the button usage range to 4-7 for the extra		* - change the button usage range to 4-7 for the extra
	* buttons		* buttons
	*/		*/
	if (*rsize >= 74 &&		if (*rsize >= 75 &&
	rdesc[61] == 0x05 && rdesc[62] == 0x08 &&		rdesc[61] == 0x05 && rdesc[62] == 0x08 &&
	rdesc[63] == 0x19 && rdesc[64] == 0x08 &&		rdesc[63] == 0x19 && rdesc[64] == 0x08 &&
	rdesc[65] == 0x29 && rdesc[66] == 0x0f &&		rdesc[65] == 0x29 && rdesc[66] == 0x0f &&

drivers/hid/hid-lg.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -345,14 +345,14 @@ static __u8 lg_report_fixup(struct hid_device hdev, __u8 *rdesc,
	struct usb_device_descriptor *udesc;		struct usb_device_descriptor *udesc;
	__u16 bcdDevice, rev_maj, rev_min;		__u16 bcdDevice, rev_maj, rev_min;

	if ((drv_data->quirks & LG_RDESC) && *rsize >= 90 && rdesc[83] == 0x26 &&		if ((drv_data->quirks & LG_RDESC) && *rsize >= 91 && rdesc[83] == 0x26 &&
	rdesc[84] == 0x8c && rdesc[85] == 0x02) {		rdesc[84] == 0x8c && rdesc[85] == 0x02) {
	hid_info(hdev,		hid_info(hdev,
	"fixing up Logitech keyboard report descriptor\n");		"fixing up Logitech keyboard report descriptor\n");
	rdesc[84] = rdesc[89] = 0x4d;		rdesc[84] = rdesc[89] = 0x4d;
	rdesc[85] = rdesc[90] = 0x10;		rdesc[85] = rdesc[90] = 0x10;
	}		}
	if ((drv_data->quirks & LG_RDESC_REL_ABS) && *rsize >= 50 &&		if ((drv_data->quirks & LG_RDESC_REL_ABS) && *rsize >= 51 &&
	rdesc[32] == 0x81 && rdesc[33] == 0x06 &&		rdesc[32] == 0x81 && rdesc[33] == 0x06 &&
	rdesc[49] == 0x81 && rdesc[50] == 0x06) {		rdesc[49] == 0x81 && rdesc[50] == 0x06) {
	hid_info(hdev,		hid_info(hdev,

drivers/hid/hid-monterey.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -24,7 +24,7 @@
	static __u8 mr_report_fixup(struct hid_device hdev, __u8 *rdesc,		static __u8 mr_report_fixup(struct hid_device hdev, __u8 *rdesc,
	unsigned int *rsize)		unsigned int *rsize)
	{		{
	if (*rsize >= 30 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {		if (*rsize >= 31 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
	hid_info(hdev, "fixing up button/consumer in HID report descriptor\n");		hid_info(hdev, "fixing up button/consumer in HID report descriptor\n");
	rdesc[30] = 0x0c;		rdesc[30] = 0x0c;
	}		}

drivers/hid/hid-petalynx.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -25,7 +25,7 @@
	static __u8 pl_report_fixup(struct hid_device hdev, __u8 *rdesc,		static __u8 pl_report_fixup(struct hid_device hdev, __u8 *rdesc,
	unsigned int *rsize)		unsigned int *rsize)
	{		{
	if (*rsize >= 60 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&		if (*rsize >= 62 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
	rdesc[41] == 0x00 && rdesc[59] == 0x26 &&		rdesc[41] == 0x00 && rdesc[59] == 0x26 &&
	rdesc[60] == 0xf9 && rdesc[61] == 0x00) {		rdesc[60] == 0xf9 && rdesc[61] == 0x00) {
	hid_info(hdev, "fixing up Petalynx Maxter Remote report descriptor\n");		hid_info(hdev, "fixing up Petalynx Maxter Remote report descriptor\n");