HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event

[ Upstream commit ffe3b7837a2bb421df84d0177481db9f52c93a71 ]

There is a slab-out-of-bounds Write bug in hid-holtek-kbd driver.
The problem is the driver assumes the device must have an input
but some malicious devices violate this assumption.

Fix this by checking hid_device's input is non-empty before its usage.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
index 2f8eb663974445f88d18e56e3d07a61b9a5385bb..72788ca260e08643a2f7ace47820da3faded4ff2 100644 (file)
--- a/drivers/hid/hid-holtek-kbd.c
+++ b/drivers/hid/hid-holtek-kbd.c
@@ -133,6 +133,10 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
                return -ENODEV;
 
        boot_hid = usb_get_intfdata(boot_interface);
+       if (list_empty(&boot_hid->inputs)) {
+               hid_err(hid, "no inputs found\n");
+               return -ENODEV;
+       }
        boot_hid_input = list_first_entry(&boot_hid->inputs,
                struct hid_input, list);