From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: Grant Hernandez <granthernandez@google.com>
Cc: linux-input@vger.kernel.org, linux-usb@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH] Input: gtco - bounds check collection indent level
Date: Sat, 13 Jul 2019 01:02:54 -0700 [thread overview]
Message-ID: <20190713080254.GB243807@dtor-ws> (raw)
In-Reply-To: <20190711222232.77701-1-granthernandez@google.com>
On Thu, Jul 11, 2019 at 03:22:32PM -0700, Grant Hernandez wrote:
> The GTCO tablet input driver configures itself from an HID report sent
> via USB during the initial enumeration process. Some debugging messages
> are generated during the parsing. A debugging message indentation
> counter is not bounds checked, leading to the ability for a specially
> crafted HID report to cause '-' and null bytes be written past the end
> of the indentation array. As long as the kernel has CONFIG_DYNAMIC_DEBUG
> enabled, this code will not be optimized out. This was discovered
> during code review after a previous syzkaller bug was found in this
> driver.
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Grant Hernandez <granthernandez@google.com>
I wish we could convert gtco to be proper HID driver, so we woudl not
have to deal with custom HID parsing, but in the meantime this is
needed.
Applied, thank you.
--
Dmitry
prev parent reply other threads:[~2019-07-13 8:02 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-11 22:22 [PATCH] Input: gtco - bounds check collection indent level Grant Hernandez
2019-07-13 8:02 ` Dmitry Torokhov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190713080254.GB243807@dtor-ws \
--to=dmitry.torokhov@gmail.com \
--cc=granthernandez@google.com \
--cc=linux-input@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).