Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

HID: core: Mitigate potential OOB by removing bogus memset()

The memset() in hid_report_raw_event() has the good intention of
clearing out bogus data by zeroing the area from the end of the incoming
data string to the assumed end of the buffer. However, as we have
previously seen, doing so can easily result in OOB reads and writes in
the subsequent thread of execution.

The current suggestion from one of the HID maintainers is to remove the
memset() and simply return if the incoming event buffer size is not
large enough to fill the associated report.

Suggested-by Benjamin Tissoires <bentiss@kernel.org>

Signed-off-by: Lee Jones <lee@kernel.org>
[bentiss: changed the return value]
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

authored by

Lee Jones and committed by
Benjamin Tissoires
0a3fe972 4bc7bc45

+4 -3
+4 -3
drivers/hid/hid-core.c
··· 2057 2057 rsize = max_buffer_size; 2058 2058 2059 2059 if (csize < rsize) { 2060 - dbg_hid("report %d is too short, (%d < %d)\n", report->id, 2061 - csize, rsize); 2062 - memset(cdata + csize, 0, rsize - csize); 2060 + hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n", 2061 + report->id, rsize, csize); 2062 + ret = -EINVAL; 2063 + goto out; 2063 2064 } 2064 2065 2065 2066 if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)