[PW_SID:1057473] Bluetooth: HIDP: reject oversized report descriptor#3330
[PW_SID:1057473] Bluetooth: HIDP: reject oversized report descriptor#3330BluezTestBot wants to merge 2 commits intoworkflowfrom
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
hidp_setup_hid() duplicates the report descriptor from userspace based on req->rd_size. hidp_session_dev_init() only checked rd_size > 0, so oversized values were accepted and propagated to memdup_user(). Reject values larger than HID_MAX_DESCRIPTOR_SIZE and return -EINVAL before entering the HID setup path. Signed-off-by: Yufan Chen <ericterminal@gmail.com>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
IncrementalBuild |
github-actions
bot
force-pushed
the
workflow
branch
4 times, most recently
from
f27164a to
e9dd054
Compare
github-actions
bot
force-pushed
the
workflow
branch
3 times, most recently
from
ab1b299 to
0bcc21a
Compare
3 participants
From: Yufan Chen ericterminal@gmail.com
hidp_setup_hid() duplicates the report descriptor from userspace
based on req->rd_size. hidp_session_dev_init() only checked
rd_size > 0, so oversized values were accepted and propagated
to memdup_user().
Reject values larger than HID_MAX_DESCRIPTOR_SIZE and return
-EINVAL before entering the HID setup path.
Signed-off-by: Yufan Chen ericterminal@gmail.com
net/bluetooth/hidp/core.c | 3 +++
1 file changed, 3 insertions(+)