Messages in this thread | | | Date | Tue, 19 Jan 2016 14:14:45 +0100 (CET) | From | Jiri Kosina <> | Subject | Re: [PATCH] HID: fix out of bound access in extract and implement |
| |
On Mon, 18 Jan 2016, Dmitry Torokhov wrote:
> extract() and implement() access buffer containing reports in 64-bit > chunks, but there is no guarantee that buffers are padded to 64 bit > boundary. In fact, KASAN has caught such OOB access with i2c-hid and > Synaptics touch controller. > > Instead of trying to hunt all parties that allocate buffers and make > sure they are padded, let's switch extract() and implement() to byte > access. It is a bit slower, bit we are not dealing with super fast > devices here. > > Also let's fix link to the HID spec while we are at it. > > Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Good catch, applied to for-4.5/upstream-fixes. Thanks,
-- Jiri Kosina SUSE Labs
| |