Re: [Linux-kernel-mentees] [PATCH v2 RESEND] usbhid: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
On Mon, Aug 17, 2020 at 12:21:41PM +0200, Jiri Kosina wrote: > On Wed, 29 Jul 2020, Peilin Ye wrote: > > > `uref->usage_index` is not always being properly checked, causing > > hiddev_ioctl_usage() to go out of bounds under some cases. Fix it. > > > > Reported-by: syzbot+34ee1b45d88571c2f...@syzkaller.appspotmail.com > > Link: > > https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802 > > Reviewed-by: Dan Carpenter > > Signed-off-by: Peilin Ye > > --- > > Change in v2: > > - Add the same check for the `HIDIOCGUSAGE` case. (Suggested by > > Dan Carpenter ) > > Applied, thanks. Thank you for reviewing the patch! Peilin Ye
Re: [Linux-kernel-mentees] [PATCH v2 RESEND] usbhid: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
On Wed, 29 Jul 2020, Peilin Ye wrote: > `uref->usage_index` is not always being properly checked, causing > hiddev_ioctl_usage() to go out of bounds under some cases. Fix it. > > Reported-by: syzbot+34ee1b45d88571c2f...@syzkaller.appspotmail.com > Link: > https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802 > Reviewed-by: Dan Carpenter > Signed-off-by: Peilin Ye > --- > Change in v2: > - Add the same check for the `HIDIOCGUSAGE` case. (Suggested by > Dan Carpenter ) Applied, thanks. -- Jiri Kosina SUSE Labs
Re: [Linux-kernel-mentees] [PATCH v2 RESEND] usbhid: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
On Wed, Jul 29, 2020 at 07:37:12AM -0400, Peilin Ye wrote: > `uref->usage_index` is not always being properly checked, causing > hiddev_ioctl_usage() to go out of bounds under some cases. Fix it. > > Reported-by: syzbot+34ee1b45d88571c2f...@syzkaller.appspotmail.com > Link: > https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802 > Reviewed-by: Dan Carpenter > Signed-off-by: Peilin Ye > --- > Change in v2: > - Add the same check for the `HIDIOCGUSAGE` case. (Suggested by > Dan Carpenter ) Why are you resending this? regards, dan carpenter
