]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Input: iforce - invert valid length check when fetching device IDs
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mon, 7 Nov 2022 18:21:40 +0000 (10:21 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 25 Nov 2022 16:42:19 +0000 (17:42 +0100)
commit5d53797ce7ce8fb1d95a5bebc5efa9418c4217a3
tree4541497a44205c2d096f043adc569e55a929dac7
parent89c0c27ab39a854b7f16fbe382a41354434c8e7d
Input: iforce - invert valid length check when fetching device IDs

commit b8ebf250997c5fb253582f42bfe98673801ebebd upstream.

syzbot is reporting uninitialized value at iforce_init_device() [1], for
commit 6ac0aec6b0a6 ("Input: iforce - allow callers supply data buffer
when fetching device IDs") is checking that valid length is shorter than
bytes to read. Since iforce_get_id_packet() stores valid length when
returning 0, the caller needs to check that valid length is longer than or
equals to bytes to read.

Reported-by: syzbot <syzbot+4dd880c1184280378821@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6ac0aec6b0a6 ("Input: iforce - allow callers supply data buffer when fetching device IDs")
Link: https://lore.kernel.org/r/531fb432-7396-ad37-ecba-3e42e7f56d5c@I-love.SAKURA.ne.jp
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/input/joystick/iforce/iforce-main.c