summaryrefslogtreecommitdiffstats
path: root/drivers/hid
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2013-08-28 22:31:44 +0200
committerJiri Kosina <jkosina@suse.cz>2013-09-04 12:01:58 +0200
commit9e8910257397372633e74b333ef891f20c800ee4 (patch)
tree3aaf2d19632500e3c45e59fe393600a86dd3434b /drivers/hid
parentHID: ntrig: validate feature report details (diff)
downloadlinux-9e8910257397372633e74b333ef891f20c800ee4.tar.xz
linux-9e8910257397372633e74b333ef891f20c800ee4.zip
HID: sensor-hub: validate feature report details
A HID device could send a malicious feature report that would cause the sensor-hub HID driver to read past the end of heap allocation, leaking kernel memory contents to the caller. CVE-2013-2898 Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@kernel.org Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/hid-sensor-hub.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index ffc80cf481b4..6fca30eb377d 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -221,7 +221,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
mutex_lock(&data->mutex);
report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
- if (!report || (field_index >= report->maxfield)) {
+ if (!report || (field_index >= report->maxfield) ||
+ report->field[field_index]->report_count < 1) {
ret = -EINVAL;
goto done_proc;
}