Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 12 Sep 2022 14:04:15 +0100
From:   Lee Jones <lee@kernel.org>
To:     Silvan Jegen <s.jegen@gmail.com>
Cc:     linux-kernel@vger.kernel.org, Jiri Kosina <jikos@kernel.org>,
        Benjamin Tissoires <benjamin.tissoires@redhat.com>,
        linux-input@vger.kernel.org
Subject: Re: [RESEND] HID: steam: Prevent NULL pointer dereference in
 steam_{recv,send}_report
Message-ID: <Yx8uT8UEK5GjOOaE@google.com>
References: <20220803111831.387506-1-lee@kernel.org>
 <Yx8cYZnmnN09lD4A@google.com>
 <3HW30DP4UX94G.2T1G25E825X7D@homearch.localdomain>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <3HW30DP4UX94G.2T1G25E825X7D@homearch.localdomain>
Precedence: bulk

On Mon, 12 Sep 2022, Silvan Jegen wrote:

> Hi
> 
> Lee Jones <lee@kernel.org> wrote:
> > On Wed, 03 Aug 2022, Lee Jones wrote:
> > 
> > > It is possible for a malicious device to forgo submitting a Feature
> > > Report.  The HID Steam driver presently makes no prevision for this
> > > and de-references the 'struct hid_report' pointer obtained from the
> > > HID devices without first checking its validity.  Let's change that.
> > 
> > This patch has been floating around since the beginning of July.
> > 
> > It fixes a real issue which was found by creating a virtual
> > (software based) malicious device and registering it as a HID device.
> > 
> > There is nothing preventing a real attacker from creating a H/W
> > version of the device in order to instigate an out-of-bounds read,
> > potentially leading to a data leak.
> > 
> > Would someone be kind enough to review please?
> 
> AFACT this patch has been applied by Jiri on the 25th of August already.

Ah, I missed his reply to the original patch.

> Is a review still needed in this case?

Certainly not.  Thank you for your reply.

-- 
Lee Jones [李琼斯]