kevin/linux
1
Fork 0
Code

HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup

Browse Source 
report_fixup for the Cougar 500k Gaming Keyboard was not verifying
that the report descriptor size was correct before accessing it

Reported-by: syzbot+24c0361074799d02c452@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452
Signed-off-by: Camila Alvarez <cam.alvarez.i@gmail.com>
Reviewed-by: Silvan Jegen <s.jegen@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Camila Alvarez 2024-07-30 19:42:43 -04:00 committed by Jiri Kosina
parent facdbdfe0e
commit a6e9c391d4
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/hid/hid-cougar.c
View File

@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void)
static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc,
unsigned int *rsize) unsigned int *rsize)
{ {
if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 &&
(rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) {
hid_info(hdev, hid_info(hdev,
"usage count exceeds max: fixing up report descriptor\n"); "usage count exceeds max: fixing up report descriptor\n");