lkml.org 
[lkml]   [2021]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 488/663] Input: joydev - prevent potential read overflow in ioctl
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream.

    The problem here is that "len" might be less than "joydev->nabs" so the
    loops which verfy abspam[i] and keypam[] might read beyond the buffer.

    Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda
    [dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP]
    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/input/joydev.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    --- a/drivers/input/joydev.c
    +++ b/drivers/input/joydev.c
    @@ -456,7 +456,7 @@ static int joydev_handle_JSIOCSAXMAP(str
    if (IS_ERR(abspam))
    return PTR_ERR(abspam);

    - for (i = 0; i < joydev->nabs; i++) {
    + for (i = 0; i < len && i < joydev->nabs; i++) {
    if (abspam[i] > ABS_MAX) {
    retval = -EINVAL;
    goto out;
    @@ -480,6 +480,9 @@ static int joydev_handle_JSIOCSBTNMAP(st
    int i;
    int retval = 0;

    + if (len % sizeof(*keypam))
    + return -EINVAL;
    +
    len = min(len, sizeof(joydev->keypam));

    /* Validate the map. */
    @@ -487,7 +490,7 @@ static int joydev_handle_JSIOCSBTNMAP(st
    if (IS_ERR(keypam))
    return PTR_ERR(keypam);

    - for (i = 0; i < joydev->nkey; i++) {
    + for (i = 0; i < (len / 2) && i < joydev->nkey; i++) {
    if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) {
    retval = -EINVAL;
    goto out;

    \
     
     \ /
      Last update: 2021-03-02 02:40    [W:3.899 / U:0.288 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site