From 53615f697f9f3e1b96cf6c9f58011bbd2e23ded9 Mon Sep 17 00:00:00 2001 From: Camila Alvarez Date: Mon, 23 Sep 2024 03:50:21 +0000 Subject: [PATCH] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup stable inclusion from stable-v4.19.322 commit e239e44dcd419b13cf840e2a3a833204e4329714 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e239e44dcd419b13cf840e2a3a833204e4329714 -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez Reviewed-by: Silvan Jegen Signed-off-by: Jiri Kosina Signed-off-by: Yipeng Zou --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index ad2e87de7dc5..d58a108a96c0 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -104,7 +104,7 @@ static void cougar_fix_g6_mapping(struct hid_device *hdev) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- Gitee