Patch "HID: hid-cypress: validate length of report" has been added to the 4.4-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
HID: hid-cypress: validate length of report
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
hid-hid-cypress-validate-length-of-report.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
1ebb71143758f45dc0fa76e2f48429e13b16d110Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <[email protected]>
Date: Fri, 6 Jan 2017 15:33:36 +0100
Subject: HID: hid-cypress: validate length of report
From: Greg Kroah-Hartman <[email protected]>
commit 1ebb71143758f45dc0fa76e2f48429e13b16d110 upstream.
Make sure we have enough of a report structure to validate before looking at it.
--- drivers/hid/hid-cypress.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-cypress.c +3 -0
@@ -39,6 +39,9 @@ static __u8 *cp_report_fixup(struct hid_if (!(quirks &CP_RDESC_SWAPPED_MIN_MAX ))return rdesc; +if (*rsize <4 ) +return rdesc; +for (i =0 ; i < *rsize -4 ; i++)if (rdesc[i] ==0x29 && rdesc[i +2 ] ==0x19 ) { rdesc[i] =0x19 ;
Patches currently in stable-queue which might be from [email protected] are
queue-4.4/net-vrf-drop-conntrack-data-after-pass-through-vrf-device-on-tx.patch queue-4.4/gro-disable-frag0-optimization-on-ipv6-ext-headers.patch queue-4.4/net-mlx5-check-fw-limitations-on-log_max_qp-before-setting-it.patch queue-4.4/net-sched-fix-soft-lockup-in-tc_classify.patch queue-4.4/net-ipv4-fix-multipath-selection-with-vrf.patch queue-4.4/ipv4-do-not-allow-main-to-be-alias-for-new-local-w-custom-rules.patch queue-4.4/net-mlx5-avoid-shadowing-numa_node.patch queue-4.4/spi-mvebu-fix-baudrate-calculation-for-armada-variant.patch queue-4.4/powerpc-fix-build-warning-on-32-bit-ppc.patch queue-4.4/r8152-split-rtl8152_suspend-function.patch queue-4.4/ipv6-handle-efault-from-skb_copy_bits.patch queue-4.4/drop_monitor-add-missing-call-to-genlmsg_end.patch queue-4.4/hid-hid-cypress-validate-length-of-report.patch queue-4.4/net-vrf-do-not-allow-table-id-0.patch queue-4.4/gro-use-min_t-in-skb_gro_reset_offset.patch queue-4.4/drop_monitor-consider-inserted-data-in-genlmsg_end.patch queue-4.4/alsa-firewire-tascam-fix-to-handle-error-from-initialization-of-stream-data.patch queue-4.4/netvsc-reduce-maximum-gso-size.patch queue-4.4/r8152-fix-rx-issue-for-runtime-suspend.patch queue-4.4/arm-zynq-reserve-correct-amount-of-non-dma-ram.patch queue-4.4/net-stmmac-fix-race-between-stmmac_drv_probe-and-stmmac_open.patch queue-4.4/arm-omap4-fix-bad-fallthrough-for-cpuidle.patch queue-4.4/gro-enter-slow-path-if-there-is-no-tailroom.patch queue-4.4/ser_gigaset-return-enomem-on-error-instead-of-success.patch queue-4.4/igmp-make-igmp-group-member-rfc-3376-compliant.patch