diff options
| author | Lee Jones <lee@kernel.org> | 2026-03-24 14:36:44 +0000 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.com> | 2026-04-09 17:35:52 +0200 |
| commit | b6a57912854e7ea36f3b270032661140cc4209cd (patch) | |
| tree | 20d83564b7c82a5815e6a8ad487b61e3bbff39bb /drivers/hid | |
| parent | a940aee176437046598dfc786b719bd96db3c74c (diff) | |
| download | linux-b6a57912854e7ea36f3b270032661140cc4209cd.tar.gz linux-b6a57912854e7ea36f3b270032661140cc4209cd.zip | |
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
logi_dj_recv_send_report() assumes that all incoming REPORT_ID_DJ_SHORT
reports are 14 Bytes (DJREPORT_SHORT_LENGTH - 1) long. It uses that
assumption to load the associated field's 'value' array with 14 Bytes of
data. However, if a malicious user only sends say 1 Byte of data,
'report_count' will be 1 and only 1 Byte of memory will be allocated to
the 'value' Byte array. When we come to populate 'value[1-13]' we will
experience an OOB write.
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/hid-logitech-dj.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c index 93f39d3e4e1b..838c6de9a921 100644 --- a/drivers/hid/hid-logitech-dj.c +++ b/drivers/hid/hid-logitech-dj.c @@ -1859,6 +1859,7 @@ static int logi_dj_probe(struct hid_device *hdev, const struct hid_device_id *id) { struct hid_report_enum *input_report_enum; + struct hid_report_enum *output_report_enum; struct hid_report *rep; struct dj_receiver_dev *djrcv_dev; struct usb_interface *intf; @@ -1903,6 +1904,15 @@ static int logi_dj_probe(struct hid_device *hdev, } } + output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT]; + rep = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT]; + + if (rep->maxfield < 1 || rep->field[0]->report_count != DJREPORT_SHORT_LENGTH - 1) { + hid_err(hdev, "Expected size of DJ short report is %d, but got %d", + DJREPORT_SHORT_LENGTH - 1, rep->field[0]->report_count); + return -EINVAL; + } + input_report_enum = &hdev->report_enum[HID_INPUT_REPORT]; /* no input reports, bail out */ |