From: Camila Alvarez Date: Tue, 30 Jul 2024 23:42:43 +0000 (-0400) Subject: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup X-Git-Tag: v5.10.226~37 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=34185de73d74fdc90e8651cfc472bfea6073a13f;p=thirdparty%2Fkernel%2Fstable.git HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup [ Upstream commit a6e9c391d45b5865b61e569146304cff72821a5d ] report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez Reviewed-by: Silvan Jegen Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin --- diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index 28d671c5e0cac..d173b13ff1983 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n");