7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiale Yao commit fc54e71a063c0dcc4bceba6d0f71805a9b84082d upstream. The HID core invokes raw_event callbacks before validating the report length. cp2112_raw_event() reads every field of a transfer status response without checking size. For a data response, it reads the length at offset two and copies that many bytes from offset three, again without ensuring that the input report contains them. Require a complete transfer status structure. For data responses, first require the header and then ensure the clamped payload length fits in the received report before copying it. Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence") added the same kind of raw_event length validation to hid-asus. Fixes: e932d8178667 ("HID: add hid-cp2112 driver") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-cp2112.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/hid/hid-cp2112.c +++ b/drivers/hid/hid-cp2112.c @@ -1430,6 +1430,9 @@ static int cp2112_raw_event(struct hid_d switch (data[0]) { case CP2112_TRANSFER_STATUS_RESPONSE: + if (size < sizeof(*xfer)) + return 0; + hid_dbg(hdev, "xfer status: %02x %02x %04x %04x\n", xfer->status0, xfer->status1, be16_to_cpu(xfer->retries), be16_to_cpu(xfer->length)); @@ -1463,11 +1466,16 @@ static int cp2112_raw_event(struct hid_d atomic_set(&dev->xfer_avail, 1); break; case CP2112_DATA_READ_RESPONSE: + if (size < 3) + return 0; + hid_dbg(hdev, "read response: %02x %02x\n", data[1], data[2]); dev->read_length = data[2]; if (dev->read_length > sizeof(dev->read_data)) dev->read_length = sizeof(dev->read_data); + if (dev->read_length > size - 3) + return 0; memcpy(dev->read_data, &data[3], dev->read_length); atomic_set(&dev->read_avail, 1); @@ -1494,4 +1502,3 @@ module_hid_driver(cp2112_driver); MODULE_DESCRIPTION("Silicon Labs HID USB to SMBus master bridge"); MODULE_AUTHOR("David Barksdale "); MODULE_LICENSE("GPL"); -