Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 5 May 2021 14:42:40 +0200 (CEST)
From:   Jiri Kosina <jikos@kernel.org>
To:     Anirudh Rayabharam <mail@anirudhrb.com>
cc:     Benjamin Tissoires <benjamin.tissoires@redhat.com>,
        gregkh@linuxfoundation.org,
        linux-kernel-mentees@lists.linuxfoundation.org,
        syzbot+7c2bb71996f95a82524c@syzkaller.appspotmail.com,
        linux-usb@vger.kernel.org, linux-input@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] usbhid: fix info leak in hid_submit_ctrl
In-Reply-To: <20210425173353.10231-1-mail@anirudhrb.com>
Message-ID: <nycvar.YFH.7.76.2105051442120.28378@cbobk.fhfr.pm>
References: <20210425173353.10231-1-mail@anirudhrb.com>
User-Agent: Alpine 2.21 (LSU 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk

On Sun, 25 Apr 2021, Anirudh Rayabharam wrote:

> In hid_submit_ctrl(), the way of calculating the report length doesn't
> take into account that report->size can be zero. When running the
> syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to
> calculate transfer_buffer_length as 16384. When this urb is passed to
> the usb core layer, KMSAN reports an info leak of 16384 bytes.
> 
> To fix this, first modify hid_report_len() to account for the zero
> report size case by using DIV_ROUND_UP for the division. Then, call it
> from hid_submit_ctrl().
> 
> Reported-by: syzbot+7c2bb71996f95a82524c@syzkaller.appspotmail.com
> Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>

Benjamin, could you please run this one through your regression testing 
machinery before we send it upstream?

Thanks,

-- 
Jiri Kosina
SUSE Labs