* [PATCH] HID: u2fzero: ignore incomplete packets without data
@ 2021-09-16 16:33 Andrej Shadura
2021-09-16 17:48 ` Andrej Shadura
2021-09-22 7:31 ` Jiri Kosina
0 siblings, 2 replies; 3+ messages in thread
From: Andrej Shadura @ 2021-09-16 16:33 UTC (permalink / raw)
To: Jiří Kosina; +Cc: linux-input, linux-usb, kernel, Benjamin Tissoires
Since the actual_length calculation is performed unsigned, packets
shorter than 7 bytes (e.g. packets without data or otherwise truncated)
or non-received packets ("zero" bytes) can cause buffer overflow.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=214437
Fixes: 42337b9d4d958("HID: add driver for U2F Zero built-in LED and RNG")
Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
---
drivers/hid/hid-u2fzero.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
index 95e0807878c7..d70cd3d7f583 100644
--- a/drivers/hid/hid-u2fzero.c
+++ b/drivers/hid/hid-u2fzero.c
@@ -198,7 +198,9 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data,
}
ret = u2fzero_recv(dev, &req, &resp);
- if (ret < 0)
+
+ /* ignore errors or packets without data */
+ if (ret < offsetof(struct u2f_hid_msg, init.data))
return 0;
/* only take the minimum amount of data it is safe to take */
--
2.31.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] HID: u2fzero: ignore incomplete packets without data
2021-09-16 16:33 [PATCH] HID: u2fzero: ignore incomplete packets without data Andrej Shadura
@ 2021-09-16 17:48 ` Andrej Shadura
2021-09-22 7:31 ` Jiri Kosina
1 sibling, 0 replies; 3+ messages in thread
From: Andrej Shadura @ 2021-09-16 17:48 UTC (permalink / raw)
To: Jiří Kosina; +Cc: linux-input, linux-usb, kernel, Benjamin Tissoires
Hi again,
On 16/09/2021 17:33, Andrej Shadura wrote:
> Since the actual_length calculation is performed unsigned, packets
> shorter than 7 bytes (e.g. packets without data or otherwise truncated)
> or non-received packets ("zero" bytes) can cause buffer overflow.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=214437
> Fixes: 42337b9d4d958("HID: add driver for U2F Zero built-in LED and RNG")
> Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
Having sent the email I realised I forgot to describe the actual
situation when I ran into this bug. It happened after I inserted and
removed the device multiple times very quickly. I know it’s not
extremely reliable way to reproduce it, and it rarely happened to me
before for some reason, but on the current kernel (5.11.0) I was able to
cause the crash every time I tried.
--
Cheers,
Andrej
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] HID: u2fzero: ignore incomplete packets without data
2021-09-16 16:33 [PATCH] HID: u2fzero: ignore incomplete packets without data Andrej Shadura
2021-09-16 17:48 ` Andrej Shadura
@ 2021-09-22 7:31 ` Jiri Kosina
1 sibling, 0 replies; 3+ messages in thread
From: Jiri Kosina @ 2021-09-22 7:31 UTC (permalink / raw)
To: Andrej Shadura; +Cc: linux-input, linux-usb, kernel, Benjamin Tissoires
On Thu, 16 Sep 2021, Andrej Shadura wrote:
> Since the actual_length calculation is performed unsigned, packets
> shorter than 7 bytes (e.g. packets without data or otherwise truncated)
> or non-received packets ("zero" bytes) can cause buffer overflow.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=214437
> Fixes: 42337b9d4d958("HID: add driver for U2F Zero built-in LED and RNG")
> Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
> ---
> drivers/hid/hid-u2fzero.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
> index 95e0807878c7..d70cd3d7f583 100644
> --- a/drivers/hid/hid-u2fzero.c
> +++ b/drivers/hid/hid-u2fzero.c
> @@ -198,7 +198,9 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data,
> }
>
> ret = u2fzero_recv(dev, &req, &resp);
> - if (ret < 0)
> +
> + /* ignore errors or packets without data */
> + if (ret < offsetof(struct u2f_hid_msg, init.data))
> return 0;
>
Applied, thanks.
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-09-22 7:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-16 16:33 [PATCH] HID: u2fzero: ignore incomplete packets without data Andrej Shadura
2021-09-16 17:48 ` Andrej Shadura
2021-09-22 7:31 ` Jiri Kosina
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).