Commit 9e891025 authored Aug 28, 2013 by Kees Cook Committed by Jiri Kosina Sep 04, 2013

HID: sensor-hub: validate feature report details



A HID device could send a malicious feature report that would cause the
sensor-hub HID driver to read past the end of heap allocation, leaking
kernel memory contents to the caller.

CVE-2013-2898

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

parent 875b4e37

drivers/hid/hid-sensor-hub.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -221,7 +221,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,

		mutex_lock(&data->mutex);
		report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
		if (!report \|\| (field_index >= report->maxfield)) {
		if (!report \|\| (field_index >= report->maxfield) \|\|
		report->field[field_index]->report_count < 1) {
		ret = -EINVAL;
		goto done_proc;
		}