Skip to content

Commit 1e4ce41

Browse files
asha1234-cyberJiri Kosina
authored andcommitted
HID: betop: fix slab-out-of-bounds Write in betop_probe
Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. Reported-by: syzbot+07efed3bc5a1407bd742@syzkaller.appspotmail.com Signed-off-by: F.A. SULAIMAN <asha.16@itfac.mrt.ac.lk> Reviewed-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
1 parent 83ec916 commit 1e4ce41

1 file changed

Lines changed: 10 additions & 3 deletions

File tree

drivers/hid/hid-betopff.c

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,15 +56,22 @@ static int betopff_init(struct hid_device *hid)
5656
{
5757
struct betopff_device *betopff;
5858
struct hid_report *report;
59-
struct hid_input *hidinput =
60-
list_first_entry(&hid->inputs, struct hid_input, list);
59+
struct hid_input *hidinput;
6160
struct list_head *report_list =
6261
&hid->report_enum[HID_OUTPUT_REPORT].report_list;
63-
struct input_dev *dev = hidinput->input;
62+
struct input_dev *dev;
6463
int field_count = 0;
6564
int error;
6665
int i, j;
6766

67+
if (list_empty(&hid->inputs)) {
68+
hid_err(hid, "no inputs found\n");
69+
return -ENODEV;
70+
}
71+
72+
hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
73+
dev = hidinput->input;
74+
6875
if (list_empty(report_list)) {
6976
hid_err(hid, "no output reports found\n");
7077
return -ENODEV;

0 commit comments

Comments
 (0)