lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

HID: fix HIDIOCGRDESC memory access in hidraw

Browse Source 
Fix bogus copying of data into userspace when HIDIOCGRDESC is issued.
HID-transport layer makes sure that dev->hid->rdesc is not larger than
HID_MAX_DESCRIPTOR_SIZE.

Noticed-by: Al Viro <viro@ftp.linux.org.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Jiri Kosina
2007-10-15 15:17:41 +02:00
committed by Linus Torvalds
parent 23fd50450a
commit 57d292bd7e
3 changed files with 24 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/hid/hidraw.c
View File

@@ -229,9 +229,15 @@ static int hidraw_ioctl(struct inode *inode, struct file *file, unsigned int cmd
if (get_user(len, (int __user *)arg))
return -EFAULT;
if (copy_to_user(*((__u8 **)(user_arg +
sizeof(__u32))),
dev->hid->rdesc, len))
if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
return -EINVAL;
if (copy_to_user(user_arg + offsetof(
struct hidraw_report_descriptor,
value[0]),
dev->hid->rdesc,
min(dev->hid->rsize, len)))
return -EFAULT;
return 0;
}