Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757261Ab3IKT5V (ORCPT ); Wed, 11 Sep 2013 15:57:21 -0400 Received: from mx1.redhat.com ([209.132.183.28]:50734 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756944Ab3IKT5S (ORCPT ); Wed, 11 Sep 2013 15:57:18 -0400 From: Benjamin Tissoires To: Benjamin Tissoires , Kees Cook , Henrik Rydberg , Jiri Kosina , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 04/10] HID: steelseries: validate output report details Date: Wed, 11 Sep 2013 21:56:53 +0200 Message-Id: <1378929419-6269-5-git-send-email-benjamin.tissoires@redhat.com> In-Reply-To: <1378929419-6269-1-git-send-email-benjamin.tissoires@redhat.com> References: <1378929419-6269-1-git-send-email-benjamin.tissoires@redhat.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1388 Lines: 46 From: Kees Cook A HID device could send a malicious output report that would cause the steelseries HID driver to write beyond the output report allocation during initialization, causing a heap overflow: [ 167.981534] usb 1-1: New USB device found, idVendor=1038, idProduct=1410 ... [ 182.050547] BUG kmalloc-256 (Tainted: G W ): Redzone overwritten CVE-2013-2891 Signed-off-by: Kees Cook Cc: stable@vger.kernel.org Reviewed-by: Benjamin Tissoires --- v3: - no changes drivers/hid/hid-steelseries.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c index d164911..29f328f 100644 --- a/drivers/hid/hid-steelseries.c +++ b/drivers/hid/hid-steelseries.c @@ -249,6 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev, goto err_free; } + if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) { + ret = -ENODEV; + goto err_free; + } + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); if (ret) { hid_err(hdev, "hw start failed\n"); -- 1.8.3.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/