diff options
| author | Ma Ke <make_ruc2021@163.com> | 2023-09-18 10:40:59 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-10-25 11:13:32 +0200 |
| commit | 010d49c773ba80bbe3600b98d7a3350201fd6913 (patch) | |
| tree | bdd46363663f8c3c8efc2c7a6b3411f082b97c11 /drivers | |
| parent | 5a4b644a565920de20d44cdb14407f957fccbd70 (diff) | |
| download | linux-010d49c773ba80bbe3600b98d7a3350201fd6913.tar.gz linux-010d49c773ba80bbe3600b98d7a3350201fd6913.tar.bz2 linux-010d49c773ba80bbe3600b98d7a3350201fd6913.zip | |
HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
[ Upstream commit ffe3b7837a2bb421df84d0177481db9f52c93a71 ]
There is a slab-out-of-bounds Write bug in hid-holtek-kbd driver.
The problem is the driver assumes the device must have an input
but some malicious devices violate this assumption.
Fix this by checking hid_device's input is non-empty before its usage.
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/hid/hid-holtek-kbd.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c index 2f8eb6639744..72788ca260e0 100644 --- a/drivers/hid/hid-holtek-kbd.c +++ b/drivers/hid/hid-holtek-kbd.c @@ -133,6 +133,10 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type, return -ENODEV; boot_hid = usb_get_intfdata(boot_interface); + if (list_empty(&boot_hid->inputs)) { + hid_err(hid, "no inputs found\n"); + return -ENODEV; + } boot_hid_input = list_first_entry(&boot_hid->inputs, struct hid_input, list); |