diff options
| author | Jiale Yao <yaojiale02@163.com> | 2026-09-24 22:29:17 +0800 |
|---|---|---|
| committer | Benjamin Tissoires <bentiss@kernel.org> | 2026-10-15 17:59:31 +0200 |
| commit | 76c51fdc825a0486f8d88ff896d39acec8f377b4 (patch) | |
| tree | 9ae3c6e1c929041631903d75c40d6cb1a1c1952e /tools/perf/scripts/python | |
| parent | 02f3607d0beb82e76481568bf631235e6a319b47 (diff) | |
HID: roccat: savu: reject short special reports
The raw event callback runs before HID core validates and zero-pads the
report. It passes the buffer to a helper which inspects data[0] and, for a
special report, reads the complete struct savu_mouse_report_special. A
truncated report can therefore cause an out-of-bounds read.
Require enough data for the special report before calling the helper.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw-event length validation to hid-asus.
Fixes: 6a2a6390cf09 ("HID: roccat: add support for Roccat Savu")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions