picolcd_debug_raw_event() decodes several fixed-format reports without first checking that the device supplied enough bytes for the fields it reads. A short report can therefore make the debug path read beyond the HID input buffer. Determine the minimum length for each decoded report and ignore reports that are too short before accessing their payload. Fixes: fabdbf2fd22f ("HID: picoLCD: split driver code") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao --- drivers/hid/hid-picolcd_debugfs.c | 32 ++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-picolcd_debugfs.c b/drivers/hid/hid-picolcd_debugfs.c index 1f7dfe60e9ba..3430ff036a6c 100644 --- a/drivers/hid/hid-picolcd_debugfs.c +++ b/drivers/hid/hid-picolcd_debugfs.c @@ -653,12 +653,43 @@ void picolcd_debug_raw_event(struct picolcd_data *data, u8 *raw_data, int size) { char *buff; + int min_size = 1; #define BUFF_SZ 256 /* Avoid unnecessary overhead if debugfs is disabled */ if (list_empty(&hdev->debug_list)) return; + switch (report->id) { + case REPORT_ERROR_CODE: + case REPORT_KEY_STATE: + case REPORT_VERSION: + case REPORT_HOOK_VERSION: + min_size = 3; + break; + case REPORT_IR_DATA: + min_size = 2; + break; + case REPORT_EE_DATA: + min_size = 4; + break; + case REPORT_MEMORY: + if (data->addr_sz == 2 || data->addr_sz == 3) + min_size = data->addr_sz + 2; + break; + case REPORT_DEVID: + min_size = 6; + break; + case REPORT_SPLASH_SIZE: + min_size = 5; + break; + default: + break; + } + + if (size < min_size) + return; + buff = kmalloc(BUFF_SZ, GFP_ATOMIC); if (!buff) return; @@ -892,4 +923,3 @@ void picolcd_exit_devfs(struct picolcd_data *data) debugfs_remove(dent); mutex_destroy(&data->mutex_flash); } - -- 2.34.1