From patchwork Mon Mar 14 22:21:04 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Torokhov X-Patchwork-Id: 8583971 Return-Path: X-Original-To: patchwork-linux-input@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 86A85C0553 for ; Mon, 14 Mar 2016 22:21:19 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 866B620375 for ; Mon, 14 Mar 2016 22:21:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6133E20306 for ; Mon, 14 Mar 2016 22:21:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751734AbcCNWVJ (ORCPT ); Mon, 14 Mar 2016 18:21:09 -0400 Received: from mail-pa0-f44.google.com ([209.85.220.44]:34838 "EHLO mail-pa0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751716AbcCNWVI (ORCPT ); Mon, 14 Mar 2016 18:21:08 -0400 Received: by mail-pa0-f44.google.com with SMTP id td3so138844389pab.2; Mon, 14 Mar 2016 15:21:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=PFLhgKxpty/+UW06geP4k7RovHEsaZd6fZ6DKAQvKOk=; b=bylh1XFkqmSUb0WC4vfOKqRQzziMG/w1+hXWSOhH2SgZMfXvsTPS8fbFwSC1HiVpPo B5WPKWSPNsV+8L8YXHuV3cI2mQGjgCMHPNgip1Dt3V73169uLonBh2nMNH4ixu4OLW6F buZWPjRs86zhOR84PYyGL7EFiuHjiKfYtGfnHV9KcJ9zfkQuZDUXx1h/XVI+zjD+7uUF ZJ5JHKM9seM88AMaiEIiDaIxNL3rAsdVSXXUFmhUW9baken81em1HJKRWkP7+Gzu1MmI IkM15xUafvWEzO5hgI9Wp/gOHoBYmEg8ftKCzrOHJStpm0fI1DN+9WvfXbbPJ22YDrue 58Wg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=PFLhgKxpty/+UW06geP4k7RovHEsaZd6fZ6DKAQvKOk=; b=SHd2o+kRHLdP0PoCZoBBGLRrX06MkMstiWqN+P0NKQZqyX9OHz1owvO6vnPG5x+9An TkNhLjmdye/wxnnrgFY/GTX7L2gQZe/fyFkCfw6KhSbKzekApYSvWIe7GYV1ua9gHHNX Ld3Xr5WhWErftZCY19ht56FpF0Ov/y0QlBwHUsEb1M7qRPgbnQOvrJD21pPArMPX2cRk B6Ff7+zZ5dNgJCjjuaUzQ2nOaTJs/1JuuMy8d2gbjmsJX+rZqVIKajKGTyduxxIdJhqD ZXQRwb1sz+so+ip5Jk7bBYLhZ15WH1gIzxzLmREg+dHFTmceBgMDLWvD8wX52degMXoK dNDg== X-Gm-Message-State: AD7BkJILtzFhRE06nIo2F5LmOC8U1T7sLlW9lxq5/kjOU/ZU3bF+cz7koOvEQ/yHlZFYDw== X-Received: by 10.66.222.199 with SMTP id qo7mr41679541pac.38.1457994067807; Mon, 14 Mar 2016 15:21:07 -0700 (PDT) Received: from dtor-ws ([2620:0:1000:1301:1585:684e:d626:5088]) by smtp.gmail.com with ESMTPSA id y68sm34489752pfi.6.2016.03.14.15.21.06 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Mon, 14 Mar 2016 15:21:07 -0700 (PDT) Date: Mon, 14 Mar 2016 15:21:04 -0700 From: Dmitry Torokhov To: Jiri Kosina Cc: Benjamin Tissoires , Mika Westerberg , Andrew Duggan , Alexander Potapenko , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report() Message-ID: <20160314222104.GA20569@dtor-ws> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Dmitry Torokhov Even though hid_hw_* checks that passed in data_len is less than HID_MAX_BUFFER_SIZE it is not enough, as i2c-hid does not necessarily allocate buffers of HID_MAX_BUFFER_SIZE but rather checks all device reports and select largest size. In-kernel users normally just send as much data as report needs, so there is no problem, but hidraw users can do whatever they please: BUG: KASAN: slab-out-of-bounds in memcpy+0x34/0x54 at addr ffffffc07135ea80 Write of size 4101 by task syz-executor/8747 CPU: 2 PID: 8747 Comm: syz-executor Tainted: G BU 3.18.0 #37 Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT) Call trace: [] dump_backtrace+0x0/0x258 arch/arm64/kernel/traps.c:83 [] show_stack+0x1c/0x2c arch/arm64/kernel/traps.c:172 [< inline >] __dump_stack lib/dump_stack.c:15 [] dump_stack+0x90/0x140 lib/dump_stack.c:50 [< inline >] print_error_description mm/kasan/report.c:97 [< inline >] kasan_report_error mm/kasan/report.c:278 [] kasan_report+0x268/0x530 mm/kasan/report.c:305 [] __asan_storeN+0x20/0x150 mm/kasan/kasan.c:718 [] memcpy+0x30/0x54 mm/kasan/kasan.c:299 [] __i2c_hid_command+0x2b0/0x7b4 drivers/hid/i2c-hid/i2c-hid.c:178 [< inline >] i2c_hid_set_or_send_report drivers/hid/i2c-hid/i2c-hid.c:321 [] i2c_hid_output_raw_report.isra.2+0x3d4/0x4b8 drivers/hid/i2c-hid/i2c-hid.c:589 [] i2c_hid_output_report+0x54/0x68 drivers/hid/i2c-hid/i2c-hid.c:602 [< inline >] hid_hw_output_report include/linux/hid.h:1039 [] hidraw_send_report+0x400/0x414 drivers/hid/hidraw.c:154 [] hidraw_write+0x40/0x64 drivers/hid/hidraw.c:177 [] vfs_write+0x1d4/0x3cc fs/read_write.c:534 [< inline >] SYSC_pwrite64 fs/read_write.c:627 [] SyS_pwrite64+0xec/0x144 fs/read_write.c:614 Object at ffffffc07135ea80, in cache kmalloc-512 Object allocated with size 268 bytes. Let's check data length against the buffer size before attempting to copy data over. Reported-by: Alexander Potapenko Signed-off-by: Dmitry Torokhov Reviewed-by: Benjamin Tissoires --- This should probably go to stable as well, leaving it to Jiri/Benjamin to decide. drivers/hid/i2c-hid/i2c-hid.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c index b921693..bb89749 100644 --- a/drivers/hid/i2c-hid/i2c-hid.c +++ b/drivers/hid/i2c-hid/i2c-hid.c @@ -283,17 +283,21 @@ static int i2c_hid_set_or_send_report(struct i2c_client *client, u8 reportType, u16 dataRegister = le16_to_cpu(ihid->hdesc.wDataRegister); u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister); u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength); + u16 size; + int args_len; + int index = 0; + + i2c_hid_dbg(ihid, "%s\n", __func__); + + if (data_len > ihid->bufsize) + return -EINVAL; - /* hid_hw_* already checked that data_len < HID_MAX_BUFFER_SIZE */ - u16 size = 2 /* size */ + + size = 2 /* size */ + (reportID ? 1 : 0) /* reportID */ + data_len /* buf */; - int args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ + + args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ + 2 /* dataRegister */ + size /* args */; - int index = 0; - - i2c_hid_dbg(ihid, "%s\n", __func__); if (!use_data && maxOutputLength == 0) return -ENOSYS;