tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

HID: multitouch: Check to ensure report responses match the request

It is possible for a malicious (or clumsy) device to respond to a
specific report's feature request using a completely different report
ID. This can cause confusion in the HID core resulting in nasty
side-effects such as OOB writes.

Add a check to ensure that the report ID in the response, matches the
one that was requested. If it doesn't, omit reporting the raw event and
return early.

Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

authored by

Lee Jones and committed by
Benjamin Tissoires e716edaf f7a4c78b

+7
+7
drivers/hid/hid-multitouch.c
··· 526 526 dev_warn(&hdev->dev, "failed to fetch feature %d\n", 527 527 report->id); 528 528 } else { 529 + /* The report ID in the request and the response should match */ 530 + if (report->id != buf[0]) { 531 + hid_err(hdev, "Returned feature report did not match the request\n"); 532 + goto free; 533 + } 534 + 529 535 ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf, 530 536 size, 0); 531 537 if (ret) 532 538 dev_warn(&hdev->dev, "failed to report feature\n"); 533 539 } 534 540 541 + free: 535 542 kfree(buf); 536 543 } 537 544