Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751590AbdIUBmP (ORCPT ); Wed, 20 Sep 2017 21:42:15 -0400 Received: from mail-io0-f169.google.com ([209.85.223.169]:47622 "EHLO mail-io0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751361AbdIUBmN (ORCPT ); Wed, 20 Sep 2017 21:42:13 -0400 X-Google-Smtp-Source: AOwi7QD2X1CT8K58r0/xL2HTBMrPLJmmbpk6iepQjGnqfKPAbsxIxGbT/6L/JMOW8EwyWLTsz/AJR7p2YPpXsylEdCY= MIME-Version: 1.0 In-Reply-To: References: From: Jaejoong Kim Date: Thu, 21 Sep 2017 10:42:12 +0900 Message-ID: Subject: Re: usb/hid: slab-out-of-bounds read in usbhid_parse To: Alan Stern Cc: Andrey Konovalov , Jiri Kosina , Benjamin Tissoires , USB list , linux-input@vger.kernel.org, LKML , syzkaller , Dmitry Vyukov , Kostya Serebryany Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1265 Lines: 41 Hi Alan 2017-09-21 0:50 GMT+09:00 Alan Stern : > On Wed, 20 Sep 2017, Kim Jaejoong wrote: > >> To. usb & input guys. >> >> While dig this report, i was wondering about bNumDescriptors in HID descriptor. >> HID document from usb.org said, 'this number must be at least one (1) >> as a Report descriptor will always be present.' >> >> There is no mention of the order of class descriptors. Suppose you >> have a HID device with a report descriptor and a physical descriptor. >> >> If you have the following hid descriptor in this case, >> HID descriptor >> bLength: 12 >> bDescriptor Type: HID >> .. skip >> bNumDescriptors: 2 >> bDescriptorType: physical >> bDescriptorLength: any >> bDescriptorType: Report >> bDescriptorLength: any >> >> If the order of the report descriptor is the second as above, >> usbhid_parse () will fail because my patch is only check the first >> bDescriptor Type. >> But If the order of the report descriptor is always first, there is no >> problem. How do you think this? > > The descriptors can appear in any order. You should not assume that > the report descriptor will always come first. Thanks for clarifying. I will resend patch with modification. Jaejoong > > Alan Stern >