| Message ID | 20240528050555.1150628-1-andrewjballance@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | hid: asus: asus_report_fixup: fix potential read out of bounds | expand |
On Tue, May 28, 2024 at 12:05:39AM -0500, Andrew Ballance wrote: > #syz test > > there may be a read out of the bounds of rdesc. > this adds bounds checks > > Signed-off-by: Andrew Ballance <andrewjballance@gmail.com> > --- > drivers/hid/hid-asus.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c > index 02de2bf4f790..37e6d25593c2 100644 > --- a/drivers/hid/hid-asus.c > +++ b/drivers/hid/hid-asus.c > @@ -1204,8 +1204,8 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc, > } > > /* match many more n-key devices */ > - if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD) { > - for (int i = 0; i < *rsize + 1; i++) { > + if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD && *rsize > 15) { > + for (int i = 0; i < *rsize - 15; i++) { Yep. This looks correct. Please resend with a complete commit message and a fixes tag etc. > /* offset to the count from 0x5a report part always 14 */ > if (rdesc[i] == 0x85 && rdesc[i + 1] == 0x5a && > rdesc[i + 14] == 0x95 && rdesc[i + 15] == 0x05) { regards, dan carpenter
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 02de2bf4f790..37e6d25593c2 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -1204,8 +1204,8 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc, } /* match many more n-key devices */ - if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD) { - for (int i = 0; i < *rsize + 1; i++) { + if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD && *rsize > 15) { + for (int i = 0; i < *rsize - 15; i++) { /* offset to the count from 0x5a report part always 14 */ if (rdesc[i] == 0x85 && rdesc[i + 1] == 0x5a && rdesc[i + 14] == 0x95 && rdesc[i + 15] == 0x05) {
#syz test there may be a read out of the bounds of rdesc. this adds bounds checks Signed-off-by: Andrew Ballance <andrewjballance@gmail.com> --- drivers/hid/hid-asus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)