diff options
| author | Benjamin Tissoires <bentiss@kernel.org> | 2026-05-04 10:47:22 +0200 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.com> | 2026-05-12 18:03:37 +0200 |
| commit | 2c85c61d1332e1e16f020d76951baf167dcb6f7a (patch) | |
| tree | e0d6bc40e0c36922e10bc72e2af8d1a136af1c4c /drivers/staging | |
| parent | b08665fe80fab0956e64741c07d9bbcec635c34d (diff) | |
HID: pass the buffer size to hid_report_raw_event
commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow. However, we can try to be smarter by providing both the buffer
size and the data size, meaning that hid_report_raw_event() can make
better decision whether we should plaining reject the buffer (buffer
overflow attempt) or if we can safely memset it to 0 and pass it to the
rest of the stack.
Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Acked-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/greybus/hid.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/greybus/hid.c b/drivers/staging/greybus/hid.c index 1f58c907c036..f1f9f6fbc00e 100644 --- a/drivers/staging/greybus/hid.c +++ b/drivers/staging/greybus/hid.c @@ -201,7 +201,7 @@ static void gb_hid_init_report(struct gb_hid *ghid, struct hid_report *report) * we just need to setup the input fields, so using * hid_report_raw_event is safe. */ - hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, size, 1); + hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, ghid->bufsize, size, 1); } static void gb_hid_init_reports(struct gb_hid *ghid) |