Patch "[PATCH 122/135] HID: core: prevent out-of-bound readings" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

[PATCH 122/135] HID: core: prevent out-of-bound readings

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
0122-HID-core-prevent-out-of-bound-readings.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Benjamin Tissoires <[email protected]>
Date: Tue, 14 Jun 2016 10:55:22 -0700
Subject: [PATCH 122/135] HID: core: prevent out-of-bound readings

[ Upstream commit 50220dead1650609206efe91f0cc116132d59b3f ]

Plugging a Logitech DJ receiver with KASAN activated raises a bunch of out-of-bound readings.

The fields are allocated up to MAX_USAGE, meaning that potentially, we do not have enough fields to fit the incoming values.
Add checks and silence KASAN.

---
 drivers/hid/hid-core.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -1251,6 +1251,7 @@ static void hid_input_field(struct hid_d
 		/* Ignore report if ErrorRollOver */
 		if (!(field->flags & HID_MAIN_ITEM_VARIABLE) &&
 		    value[n] >= min && value[n] <= max &&
+		    value[n] - min < field->maxusage &&
 		    field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)
 			goto exit;
 	}

@@ -1263,11 +1264,13 @@ static void hid_input_field(struct hid_d
 		}
 
 		if (field->value[n] >= min && field->value[n] <= max
+			&& field->value[n] - min < field->maxusage
 			&& field->usage[field->value[n] - min].hid
 			&& search(value, field->value[n], count))
 				hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, interrupt);
 
 		if (value[n] >= min && value[n] <= max
+			&& value[n] - min < field->maxusage
 			&& field->usage[value[n] - min].hid
 			&& search(field->value, value[n], count))
 				hid_process_event(hid, field, &field->usage[value[n] - min], 1, interrupt);

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/0122-HID-core-prevent-out-of-bound-readings.patch