out of bounds access in hiddev_cleanup
PATCH 1/1 out of bounds access in hiddev_cleanup
hiddev_table[] is an array of pointers. the minor number is used as an offset. hiddev minors start either with zero, or with 96. If they start with 96, the offset must be reduced by HIDDEV_MINOR_BASE because only 16 minors are available.
unplugging a hiddevice will zero data outside the hiddev_table array.
this was spotted by Takashi Iwai.
drivers/usb/input/hiddev.c renamed from drivers/usb/input/hiddev.c-dist +1 -1
@@ -232,7 +232,7 @@ static int hiddev_fasync(int fd, structstatic struct usb_class_driver hiddev_class;static void hiddev_cleanup (struct hiddev *hiddev) { - hiddev_table[hiddev->hid->minor] =NULL ; + hiddev_table[hiddev->hid->minor -HIDDEV_MINOR_BASE ] =NULL ;usb_deregister_dev (hiddev->hid->intf, &hiddev_class);kfree (hiddev); }
Signature · 3 lines
USB is for mice, FireWire is for men! sUse lINUX ag, nÜRNBERG
Quoted 12 lines · Olaf Hering
hiddev_table[] is an array of pointers. the minor number is used as an offset. hiddev minors start either with zero, or with 96. If they start with 96, the offset must be reduced by
HIDDEV_MINOR_BASEbecause only 16 minors are available.
unplugging a hiddevice will zero data outside thehiddev_tablearray.this was spotted by Takashi Iwai.
drivers/usb/input/hiddev.c static int hiddev_fasync(int fd, struct · line 238
Quoted 8 lines
drivers/usb/input/hiddev.c renamed from drivers/usb/input/hiddev.c-dist +1
-1@@ -232,7 +232,7 @@ static int hiddev_fasync(int fd, structstatic struct usb_class_driver hiddev_class;static void hiddev_cleanup (struct hiddev *hiddev) { - hiddev_table[hiddev->hid->minor] =NULL ; + hiddev_table[hiddev->hid->minor -HIDDEV_MINOR_BASE ] =NULL ;usb_deregister_dev (hiddev->hid->intf, &hiddev_class);kfree (hiddev); }
Already applied to my tree, thanks for forwarding it anyway.
Signature · 2 lines
Vojtech Pavlik SuSE Labs, SuSE CR