[Linux-kernel-mentees] [PATCH v2 RESEND] usbhid: Fix slab-out-of-bounds write in hiddev_ioctl_usage()

Peilin Ye yepeilin.cs at gmail.com
Tue Aug 18 10:00:08 UTC 2020


On Mon, Aug 17, 2020 at 12:21:41PM +0200, Jiri Kosina wrote:
> On Wed, 29 Jul 2020, Peilin Ye wrote:
> 
> > `uref->usage_index` is not always being properly checked, causing
> > hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.
> > 
> > Reported-by: syzbot+34ee1b45d88571c2fa8b at syzkaller.appspotmail.com
> > Link: https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802
> > Reviewed-by: Dan Carpenter <dan.carpenter at oracle.com>
> > Signed-off-by: Peilin Ye <yepeilin.cs at gmail.com>
> > ---
> > Change in v2:
> >     - Add the same check for the `HIDIOCGUSAGE` case. (Suggested by
> >       Dan Carpenter <dan.carpenter at oracle.com>)
> 
> Applied, thanks.

Thank you for reviewing the patch!

Peilin Ye


More information about the Linux-kernel-mentees mailing list