releases/4.6.5/hid-hiddev-validate-num_values-for-hidiocgusages-hidiocsusages-commands.patch

   1 From 93a2001bdfd5376c3dc2158653034c20392d15c5 Mon Sep 17 00:00:00 2001
   2 From: Scott Bauer <sbauer@plzdonthack.me>
   3 Date: Thu, 23 Jun 2016 08:59:47 -0600
   4 Subject: HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
   5
   6 From: Scott Bauer <sbauer@plzdonthack.me>
   7
   8 commit 93a2001bdfd5376c3dc2158653034c20392d15c5 upstream.
   9
  10 This patch validates the num_values parameter from userland during the
  11 HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
  12 to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
  13 leading to a heap overflow.
  14
  15 Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
  16 Signed-off-by: Jiri Kosina <jkosina@suse.cz>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18
  19 ---
  20  drivers/hid/usbhid/hiddev.c |   10 +++++-----
  21  1 file changed, 5 insertions(+), 5 deletions(-)
  22
  23 --- a/drivers/hid/usbhid/hiddev.c
  24 +++ b/drivers/hid/usbhid/hiddev.c
  25 @@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(s
  26                                         goto inval;
  27                         } else if (uref->usage_index >= field->report_count)
  28                                 goto inval;
  29 -
  30 -                       else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
  31 -                                (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
  32 -                                 uref->usage_index + uref_multi->num_values > field->report_count))
  33 -                               goto inval;
  34                 }
  35
  36 +               if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
  37 +                   (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
  38 +                    uref->usage_index + uref_multi->num_values > field->report_count))
  39 +                       goto inval;
  40 +
  41                 switch (cmd) {
  42                 case HIDIOCGUSAGE:
  43                         uref->value = field->value[uref->usage_index];