lkml.org 
[lkml]   [2021]   [May]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] usbhid: fix info leak in hid_submit_ctrl
On Wed, May 5, 2021 at 2:42 PM Jiri Kosina <jikos@kernel.org> wrote:
>
> On Sun, 25 Apr 2021, Anirudh Rayabharam wrote:
>
> > In hid_submit_ctrl(), the way of calculating the report length doesn't
> > take into account that report->size can be zero. When running the
> > syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to
> > calculate transfer_buffer_length as 16384. When this urb is passed to
> > the usb core layer, KMSAN reports an info leak of 16384 bytes.
> >
> > To fix this, first modify hid_report_len() to account for the zero
> > report size case by using DIV_ROUND_UP for the division. Then, call it
> > from hid_submit_ctrl().
> >
> > Reported-by: syzbot+7c2bb71996f95a82524c@syzkaller.appspotmail.com
> > Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
>
> Benjamin, could you please run this one through your regression testing
> machinery before we send it upstream?
>

I don't have a reproducer like syzbot has for the exact bug here, as I
am relying on one real USB device to check if usbhid is not too
broken.
However, the test suite should catch if there is an error implied by
the hid_report_len() change.

Anyway, I manually started the job and will report when it is done.

Cheers,
Benjamin

\
 
 \ /
  Last update: 2021-05-05 15:27    [W:1.484 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site