diff options
| author | Jiale Yao <yaojiale02@163.com> | 2026-09-24 22:44:06 +0800 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.com> | 2026-10-16 11:36:46 +0200 |
| commit | fc54e71a063c0dcc4bceba6d0f71805a9b84082d (patch) | |
| tree | e884e5dc9623b99470bb85cc315092f9efa2b485 /drivers/hid | |
| parent | c6c0df8a4b73a0d563c5e64de640ef5ff525fc82 (diff) | |
HID: cp2112: validate response report lengths
The HID core invokes raw_event callbacks before validating the report
length. cp2112_raw_event() reads every field of a transfer status response
without checking size. For a data response, it reads the length at offset
two and copies that many bytes from offset three, again without ensuring
that the input report contains them.
Require a complete transfer status structure. For data responses, first
require the header and then ensure the clamped payload length fits in the
received report before copying it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: e932d8178667 ("HID: add hid-cp2112 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/hid-cp2112.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c index 04379db93571..6b938f75e72f 100644 --- a/drivers/hid/hid-cp2112.c +++ b/drivers/hid/hid-cp2112.c @@ -1430,6 +1430,9 @@ static int cp2112_raw_event(struct hid_device *hdev, struct hid_report *report, switch (data[0]) { case CP2112_TRANSFER_STATUS_RESPONSE: + if (size < sizeof(*xfer)) + return 0; + hid_dbg(hdev, "xfer status: %02x %02x %04x %04x\n", xfer->status0, xfer->status1, be16_to_cpu(xfer->retries), be16_to_cpu(xfer->length)); @@ -1463,11 +1466,16 @@ static int cp2112_raw_event(struct hid_device *hdev, struct hid_report *report, atomic_set(&dev->xfer_avail, 1); break; case CP2112_DATA_READ_RESPONSE: + if (size < 3) + return 0; + hid_dbg(hdev, "read response: %02x %02x\n", data[1], data[2]); dev->read_length = data[2]; if (dev->read_length > sizeof(dev->read_data)) dev->read_length = sizeof(dev->read_data); + if (dev->read_length > size - 3) + return 0; memcpy(dev->read_data, &data[3], dev->read_length); atomic_set(&dev->read_avail, 1); @@ -1494,4 +1502,3 @@ module_hid_driver(cp2112_driver); MODULE_DESCRIPTION("Silicon Labs HID USB to SMBus master bridge"); MODULE_AUTHOR("David Barksdale <dbarksdale@uplogix.com>"); MODULE_LICENSE("GPL"); - |