From: Hans de Goede <hdegoede@redhat.com> To: Jiri Kosina <jikos@kernel.org>, Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: "Hans de Goede" <hdegoede@redhat.com>, "Marek Behún" <kabel@kernel.org>, linux-input@vger.kernel.org, linux-leds@vger.kernel.org, alsa-devel@alsa-project.org Subject: [PATCH v3 3/7] HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event() Date: Sun, 21 Feb 2021 12:20:01 +0100 [thread overview] Message-ID: <20210221112005.102116-4-hdegoede@redhat.com> (raw) In-Reply-To: <20210221112005.102116-1-hdegoede@redhat.com> The HID lenovo probe function only attaches drvdata to one of the USB interfaces, but lenovo_event() will get called for all USB interfaces to which hid-lenovo is bound. This allows a malicious device to fake being a device handled by hid-lenovo, which generates events for which lenovo_event() has special handling (and thus dereferences hid_get_drvdata()) on another interface triggering a NULL pointer exception. Add a check for hid_get_drvdata() returning NULL, avoiding this possible NULL pointer exception. Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support") Reviewed-by: Marek Behún <kabel@kernel.org> Signed-off-by: Hans de Goede <hdegoede@redhat.com> --- drivers/hid/hid-lenovo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c index ee175ab54281..b2596ed37880 100644 --- a/drivers/hid/hid-lenovo.c +++ b/drivers/hid/hid-lenovo.c @@ -508,6 +508,9 @@ static int lenovo_event_cptkbd(struct hid_device *hdev, static int lenovo_event(struct hid_device *hdev, struct hid_field *field, struct hid_usage *usage, __s32 value) { + if (!hid_get_drvdata(hdev)) + return 0; + switch (hdev->product) { case USB_DEVICE_ID_LENOVO_CUSBKBD: case USB_DEVICE_ID_LENOVO_CBTKBD: -- 2.30.1
WARNING: multiple messages have this Message-ID (diff)
From: Hans de Goede <hdegoede@redhat.com> To: Jiri Kosina <jikos@kernel.org>, Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: "Marek Behún" <kabel@kernel.org>, "Hans de Goede" <hdegoede@redhat.com>, alsa-devel@alsa-project.org, linux-leds@vger.kernel.org, linux-input@vger.kernel.org Subject: [PATCH v3 3/7] HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event() Date: Sun, 21 Feb 2021 12:20:01 +0100 [thread overview] Message-ID: <20210221112005.102116-4-hdegoede@redhat.com> (raw) In-Reply-To: <20210221112005.102116-1-hdegoede@redhat.com> The HID lenovo probe function only attaches drvdata to one of the USB interfaces, but lenovo_event() will get called for all USB interfaces to which hid-lenovo is bound. This allows a malicious device to fake being a device handled by hid-lenovo, which generates events for which lenovo_event() has special handling (and thus dereferences hid_get_drvdata()) on another interface triggering a NULL pointer exception. Add a check for hid_get_drvdata() returning NULL, avoiding this possible NULL pointer exception. Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support") Reviewed-by: Marek Behún <kabel@kernel.org> Signed-off-by: Hans de Goede <hdegoede@redhat.com> --- drivers/hid/hid-lenovo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c index ee175ab54281..b2596ed37880 100644 --- a/drivers/hid/hid-lenovo.c +++ b/drivers/hid/hid-lenovo.c @@ -508,6 +508,9 @@ static int lenovo_event_cptkbd(struct hid_device *hdev, static int lenovo_event(struct hid_device *hdev, struct hid_field *field, struct hid_usage *usage, __s32 value) { + if (!hid_get_drvdata(hdev)) + return 0; + switch (hdev->product) { case USB_DEVICE_ID_LENOVO_CUSBKBD: case USB_DEVICE_ID_LENOVO_CBTKBD: -- 2.30.1
next prev parent reply other threads:[~2021-02-21 11:21 UTC|newest] Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-02-21 11:19 [PATCH v3 0/7] HID: lenovo: Mute LED handling fixes and improvements Hans de Goede 2021-02-21 11:19 ` Hans de Goede 2021-02-21 11:19 ` [PATCH v3 1/7] HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness Hans de Goede 2021-02-21 11:19 ` Hans de Goede 2021-02-21 11:20 ` [PATCH v3 2/7] HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling Hans de Goede 2021-02-21 11:20 ` Hans de Goede 2021-02-21 11:29 ` Marek Behún 2021-02-21 11:29 ` Marek Behún 2021-02-21 11:20 ` Hans de Goede [this message] 2021-02-21 11:20 ` [PATCH v3 3/7] HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event() Hans de Goede 2021-02-21 11:20 ` [PATCH v3 4/7] HID: lenovo: Remove lenovo_led_brightness_get() Hans de Goede 2021-02-21 11:20 ` Hans de Goede 2021-02-23 9:03 ` Pavel Machek 2021-02-23 9:03 ` Pavel Machek 2021-02-21 11:20 ` [PATCH v3 5/7] HID: lenovo: Set LEDs max_brightness value Hans de Goede 2021-02-21 11:20 ` Hans de Goede 2021-02-21 11:29 ` Marek Behún 2021-02-21 11:29 ` Marek Behún 2021-02-23 9:03 ` Pavel Machek 2021-02-23 9:03 ` Pavel Machek 2021-02-21 11:20 ` [PATCH v3 6/7] HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE Hans de Goede 2021-02-21 11:20 ` Hans de Goede 2021-02-21 11:30 ` Marek Behún 2021-02-21 11:30 ` Marek Behún 2021-02-21 11:20 ` [PATCH v3 7/7] HID: lenovo: Set default_triggers for the mute and micmute LEDs Hans de Goede 2021-02-21 11:20 ` Hans de Goede 2021-02-23 9:04 ` Pavel Machek 2021-02-23 9:04 ` Pavel Machek
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210221112005.102116-4-hdegoede@redhat.com \ --to=hdegoede@redhat.com \ --cc=alsa-devel@alsa-project.org \ --cc=benjamin.tissoires@redhat.com \ --cc=jikos@kernel.org \ --cc=kabel@kernel.org \ --cc=linux-input@vger.kernel.org \ --cc=linux-leds@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.