diff options
| author | Jiale Yao <yaojiale02@163.com> | 2026-09-24 22:44:13 +0800 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.com> | 2026-10-16 11:36:47 +0200 |
| commit | 9932c9af185f8586e883d44ca562c12f4487c762 (patch) | |
| tree | 8135c1ff8bfb61b520578f574aaf39fc2347d487 /tools/perf/scripts/python | |
| parent | 0deb22da5a8c6663c3e071f55fd7d7e3189f5517 (diff) | |
HID: zydacron: validate key report length
The HID core invokes raw_event callbacks before validating the report
length. zc_raw_event() verifies the report ID in byte zero and then reads
the key code from byte one for report IDs 0x02 and 0x03 without checking
that the second byte is present.
A one-byte report reproduced the issue under KASAN:
BUG: KASAN: slab-out-of-bounds in zc_raw_event+0x54c/0x580
Read of size 1 by task hidtrigger/93
Call Trace:
zc_raw_event+0x54c/0x580
__hid_input_report+0x2ef/0x3a0
inject_store+0x479/0x490 [faketrans]
Require both the report ID and key code before processing the report.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: d0742abaa1c3 ("HID: add omitted hid-zydacron.c file")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions