[Acked] [PATCH][SRU PTUVWX] HID: core: prevent out-of-bound readings

[Andy Whitcroft]

On Tue, Jun 14, 2016 at 10:55:22AM -0700, Kamal Mostafa wrote:
> From: Benjamin Tissoires <benjamin.tissoires at redhat.com>
> 
> BugLink: http://bugs.launchpad.net/bugs/1579190
> 
> Plugging a Logitech DJ receiver with KASAN activated raises a bunch of
> out-of-bound readings.
> 
> The fields are allocated up to MAX_USAGE, meaning that potentially, we do
> not have enough fields to fit the incoming values.
> Add checks and silence KASAN.
> 
> Signed-off-by: Benjamin Tissoires <benjamin.tissoires at redhat.com>
> Signed-off-by: Jiri Kosina <jkosina at suse.cz>
> (cherry picked from commit 50220dead1650609206efe91f0cc116132d59b3f)
> Signed-off-by: Kamal Mostafa <kamal at canonical.com>
> ---
>  drivers/hid/hid-core.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> index ec791e1..9369602 100644
> --- a/drivers/hid/hid-core.c
> +++ b/drivers/hid/hid-core.c
> @@ -1251,6 +1251,7 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
>  		/* Ignore report if ErrorRollOver */
>  		if (!(field->flags & HID_MAIN_ITEM_VARIABLE) &&
>  		    value[n] >= min && value[n] <= max &&
> +		    value[n] - min < field->maxusage &&
>  		    field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)
>  			goto exit;
>  	}
> @@ -1263,11 +1264,13 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
>  		}
>  
>  		if (field->value[n] >= min && field->value[n] <= max
> +			&& field->value[n] - min < field->maxusage
>  			&& field->usage[field->value[n] - min].hid
>  			&& search(value, field->value[n], count))
>  				hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, interrupt);
>  
>  		if (value[n] >= min && value[n] <= max
> +			&& value[n] - min < field->maxusage
>  			&& field->usage[value[n] - min].hid
>  			&& search(field->value, value[n], count))
>  				hid_process_event(hid, field, &field->usage[value[n] - min], 1, interrupt);

Looks sane enough.

Acked-by: Andy Whitcroft <apw at canonical.com>

-apw