Commit ffe3b783 authored by Ma Ke's avatar Ma Ke Committed by Jiri Kosina
Browse files

HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event 



There is a slab-out-of-bounds Write bug in hid-holtek-kbd driver.
The problem is the driver assumes the device must have an input
but some malicious devices violate this assumption.

Fix this by checking hid_device's input is non-empty before its usage.

Signed-off-by: default avatarMa Ke <make_ruc2021@163.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 05857487

drivers/hid/hid-holtek-kbd.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -130,6 +130,10 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type, 
		return -ENODEV;

		return -ENODEV;





	boot_hid = usb_get_intfdata(boot_interface);

	boot_hid = usb_get_intfdata(boot_interface);

	if (list_empty(&boot_hid->inputs)) {

		hid_err(hid, "no inputs found\n");

		return -ENODEV;

	}

	boot_hid_input = list_first_entry(&boot_hid->inputs,

	boot_hid_input = list_first_entry(&boot_hid->inputs,

		struct hid_input, list);

		struct hid_input, list);