| Date | Tue, 1 Sep 2020 21:12:09 +0200 | From | Pavel Machek <> | Subject | Re: [PATCH 4.19 124/125] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() |
| |
Hi!
> commit 25a097f5204675550afb879ee18238ca917cba7a upstream. > > `uref->usage_index` is not always being properly checked, causing > hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.
Well, the code is quite confusig, but:
a) does HIDIOCGCOLLECTIONINDEX need same checking?
b) should we check this using some kind of _nospec() variant to prevent speculation attacks?
Best regards, Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html [unhandled content-type:application/pgp-signature] |