Commit 6f562d23 authored Jun 23, 2016 by Scott Bauer Committed by Sasha Levin Jul 12, 2016

HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands



[ Upstream commit 93a2001bdfd5376c3dc2158653034c20392d15c5 ]

This patch validates the num_values parameter from userland during the
HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
leading to a heap overflow.

Cc: stable@vger.kernel.org
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

parent 1b9dc668

drivers/hid/usbhid/hiddev.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -516,12 +516,12 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
		goto inval;
		} else if (uref->usage_index >= field->report_count)
		goto inval;
		}

		else if ((cmd == HIDIOCGUSAGES \|\| cmd == HIDIOCSUSAGES) &&
		if ((cmd == HIDIOCGUSAGES \|\| cmd == HIDIOCSUSAGES) &&
		(uref_multi->num_values > HID_MAX_MULTI_USAGES \|\|
		uref->usage_index + uref_multi->num_values > field->report_count))
		goto inval;
		}

		switch (cmd) {
		case HIDIOCGUSAGE: