7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiale Yao commit 1cb92fcb2ac344d78737e3c5cb7b061dfb2850b1 upstream. The HID core invokes raw_event callbacks before validating the report length. elo_raw_event() only checks the first-byte packet marker before elo_process_data() reads coordinates, flags, and pressure through offset seven. A truncated packet beginning with the expected marker can therefore cause an out-of-bounds read. Require the complete eight-byte SmartSet packet before parsing it. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: d23efc19478a ("HID: add driver for ELO 4000/4500") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-elo.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/hid/hid-elo.c +++ b/drivers/hid/hid-elo.c @@ -85,6 +85,9 @@ static int elo_raw_event(struct hid_devi if (!(hdev->claimed & HID_CLAIMED_INPUT) || list_empty(&hdev->inputs)) return 0; + if (size < ELO_SMARTSET_PACKET_SIZE) + return 0; + hidinput = list_first_entry(&hdev->inputs, struct hid_input, list); switch (report->id) {