From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Mark Salyzyn <salyzyn@android.com>,
Marcel Holtmann <marcel@holtmann.org>,
Johan Hedberg <johan.hedberg@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
Kees Cook <keescook@chromium.org>,
Benjamin Tissoires <benjamin.tissoires@redhat.com>,
linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org,
security@kernel.org, kernel-team@android.com
Subject: [PATCH 4.18 20/22] Bluetooth: hidp: buffer overflow in hidp_process_report
Date: Thu, 16 Aug 2018 20:45:36 +0200 [thread overview]
Message-ID: <20180816171557.318550452@linuxfoundation.org> (raw)
In-Reply-To: <20180816171556.502583508@linuxfoundation.org>
4.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Salyzyn <salyzyn@android.com>
commit 7992c18810e568b95c869b227137a2215702a805 upstream.
CVE-2018-9363
The buffer length is unsigned at all layers, but gets cast to int and
checked in hidp_process_report and can lead to a buffer overflow.
Switch len parameter to unsigned int to resolve issue.
This affects 3.18 and newer kernels.
Signed-off-by: Mark Salyzyn <salyzyn@android.com>
Fixes: a4b1b5877b514b276f0f31efe02388a9c2836728 ("HID: Bluetooth: hidp: make sure input buffers are big enough")
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Kees Cook <keescook@chromium.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-bluetooth@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: security@kernel.org
Cc: kernel-team@android.com
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hidp/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -431,8 +431,8 @@ static void hidp_del_timer(struct hidp_s
del_timer(&session->timer);
}
-static void hidp_process_report(struct hidp_session *session,
- int type, const u8 *data, int len, int intr)
+static void hidp_process_report(struct hidp_session *session, int type,
+ const u8 *data, unsigned int len, int intr)
{
if (len > HID_MAX_BUFFER_SIZE)
len = HID_MAX_BUFFER_SIZE;
next prev parent reply other threads:[~2018-08-16 18:48 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-16 18:45 [PATCH 4.18 00/22] 4.18.2-stable review Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 01/22] x86/l1tf: Fix build error seen if CONFIG_KVM_INTEL is disabled Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 02/22] x86: i8259: Add missing include file Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 03/22] x86/hyper-v: Check for VP_INVAL in hyperv_flush_tlb_others() Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 04/22] x86/platform/UV: Mark memblock related init code and data correctly Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 05/22] x86/mm/pti: Clear Global bit more aggressively Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 06/22] xen/pv: Call get_cpu_address_sizes to set x86_virt/phys_bits Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 07/22] x86/mm: Disable ioremap free page handling on x86-PAE Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 08/22] kbuild: verify that $DEPMOD is installed Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 09/22] crypto: ccree - fix finup Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 10/22] crypto: ccree - fix iv handling Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 11/22] crypto: ccp - Check for NULL PSP pointer at module unload Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 12/22] crypto: ccp - Fix command completion detection race Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 13/22] crypto: x86/sha256-mb - fix digest copy in sha256_mb_mgr_get_comp_job_avx2() Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 14/22] crypto: vmac - require a block cipher with 128-bit block size Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 15/22] crypto: vmac - separate tfm and request context Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 16/22] crypto: blkcipher - fix crash flushing dcache in error path Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 17/22] crypto: ablkcipher " Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 18/22] crypto: skcipher - fix aligning block size in skcipher_copy_iv() Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 19/22] crypto: skcipher - fix crash flushing dcache in error path Greg Kroah-Hartman
2018-08-16 18:45 ` Greg Kroah-Hartman [this message]
2018-08-16 18:45 ` [PATCH 4.18 21/22] ioremap: Update pgtable free interfaces with addr Greg Kroah-Hartman
2018-08-16 18:45 ` [PATCH 4.18 22/22] x86/mm: Add TLB purge to free pmd/pte page interfaces Greg Kroah-Hartman
2018-08-17 17:18 ` [PATCH 4.18 00/22] 4.18.2-stable review Guenter Roeck
2018-08-17 17:25 ` Greg Kroah-Hartman
2018-08-18 14:21 ` Rafael David Tinoco
2018-08-18 15:22 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180816171557.318550452@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=benjamin.tissoires@redhat.com \
--cc=davem@davemloft.net \
--cc=johan.hedberg@gmail.com \
--cc=keescook@chromium.org \
--cc=kernel-team@android.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=netdev@vger.kernel.org \
--cc=salyzyn@android.com \
--cc=security@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).