Commit 2b658c1c authored by Benjamin Tissoires's avatar Benjamin Tissoires
Browse files

HID: bpf: prevent buffer overflow in hid_hw_request 



right now the returned value is considered to be always valid. However,
when playing with HID-BPF, the return value can be arbitrary big,
because it's the return value of dispatch_hid_bpf_raw_requests(), which
calls the struct_ops and we have no guarantees that the value makes
sense.

Fixes: 8bd0488b ("HID: bpf: add HID-BPF hooks for hid_hw_raw_requests")
Cc: stable@vger.kernel.org
Acked-by: default avatarJiri Kosina <jkosina@suse.com>
Signed-off-by: default avatarBenjamin Tissoires <bentiss@kernel.org>
parent 5d4c6c13

drivers/hid/bpf/hid_bpf_dispatch.c

+2 −0
Original line number Diff line number Diff line
@@ -444,6 +444,8 @@ hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz, 
					      (u64)(long)ctx,

					      true); /* prevent infinite recursions */



	if (ret > size)

		ret = size;

	if (ret > 0)

		memcpy(buf, dma_data, ret);