mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-11-01 02:21:16 +00:00
187d27cc7e
commit d9d4b1e46d9543a82c23f6df03f4ad697dab361b upstream. The syzbot fuzzer found a slab-out-of-bounds write bug in the hid-gaff driver. The problem is caused by the driver's assumption that the device must have an input report. While this will be true for all normal HID input devices, a suitably malicious device can violate the assumption. The same assumption is present in over a dozen other HID drivers. This patch fixes them by checking that the list of hid_inputs for the hid_device is nonempty before allowing it to be used. Reported-and-tested-by: syzbot+403741a091bf41d4ae79@syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Lee Jones <lee.jones@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ica4d1b6adc1bcb30ce077f7d954cb8ba94bce730 |
||
|---|---|---|
| .. | ||
| i2c-hid | ||
| usbhid | ||
| hid-a4tech.c | ||
| hid-apple.c | ||
| hid-appleir.c | ||
| hid-aureal.c | ||
| hid-axff.c | ||
| hid-belkin.c | ||
| hid-cherry.c | ||
| hid-chicony.c | ||
| hid-core.c | ||
| hid-cypress.c | ||
| hid-debug.c | ||
| hid-dr.c | ||
| hid-elecom.c | ||
| hid-emsff.c | ||
| hid-ezkey.c | ||
| hid-gaff.c | ||
| hid-generic.c | ||
| hid-gyration.c | ||
| hid-holtek-kbd.c | ||
| hid-holtekff.c | ||
| hid-hyperv.c | ||
| hid-icade.c | ||
| hid-ids.h | ||
| hid-input.c | ||
| hid-kensington.c | ||
| hid-keytouch.c | ||
| hid-kye.c | ||
| hid-lcpower.c | ||
| hid-lenovo-tpkbd.c | ||
| hid-lg.c | ||
| hid-lg.h | ||
| hid-lg2ff.c | ||
| hid-lg3ff.c | ||
| hid-lg4ff.c | ||
| hid-lgff.c | ||
| hid-logitech-dj.c | ||
| hid-logitech-dj.h | ||
| hid-magicmouse.c | ||
| hid-microsoft.c | ||
| hid-monterey.c | ||
| hid-multitouch.c | ||
| hid-ntrig.c | ||
| hid-ortek.c | ||
| hid-petalynx.c | ||
| hid-picolcd.h | ||
| hid-picolcd_backlight.c | ||
| hid-picolcd_cir.c | ||
| hid-picolcd_core.c | ||
| hid-picolcd_debugfs.c | ||
| hid-picolcd_fb.c | ||
| hid-picolcd_lcd.c | ||
| hid-picolcd_leds.c | ||
| hid-pl.c | ||
| hid-primax.c | ||
| hid-prodikeys.c | ||
| hid-ps3remote.c | ||
| hid-roccat-arvo.c | ||
| hid-roccat-arvo.h | ||
| hid-roccat-common.c | ||
| hid-roccat-common.h | ||
| hid-roccat-isku.c | ||
| hid-roccat-isku.h | ||
| hid-roccat-kone.c | ||
| hid-roccat-kone.h | ||
| hid-roccat-koneplus.c | ||
| hid-roccat-koneplus.h | ||
| hid-roccat-konepure.c | ||
| hid-roccat-konepure.h | ||
| hid-roccat-kovaplus.c | ||
| hid-roccat-kovaplus.h | ||
| hid-roccat-lua.c | ||
| hid-roccat-lua.h | ||
| hid-roccat-pyra.c | ||
| hid-roccat-pyra.h | ||
| hid-roccat-savu.c | ||
| hid-roccat-savu.h | ||
| hid-roccat.c | ||
| hid-saitek.c | ||
| hid-samsung.c | ||
| hid-sensor-hub.c | ||
| hid-sjoy.c | ||
| hid-sony.c | ||
| hid-speedlink.c | ||
| hid-steelseries.c | ||
| hid-sunplus.c | ||
| hid-synaptics-bt.c | ||
| hid-thingm.c | ||
| hid-tivo.c | ||
| hid-tmff.c | ||
| hid-topseed.c | ||
| hid-twinhan.c | ||
| hid-uclogic.c | ||
| hid-wacom.c | ||
| hid-waltop.c | ||
| hid-wiimote-core.c | ||
| hid-wiimote-debug.c | ||
| hid-wiimote-ext.c | ||
| hid-wiimote.h | ||
| hid-zpff.c | ||
| hid-zydacron.c | ||
| hidraw.c | ||
| Kconfig | ||
| Makefile | ||
| uhid.c | ||