Commit 6be388f4 authored by Anirudh Rayabharam's avatar Anirudh Rayabharam Committed by Jiri Kosina
Browse files

HID: usbhid: fix info leak in hid_submit_ctrl 



In hid_submit_ctrl(), the way of calculating the report length doesn't
take into account that report->size can be zero. When running the
syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to
calculate transfer_buffer_length as 16384. When this urb is passed to
the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero
report size case by using DIV_ROUND_UP for the division. Then, call it
from hid_submit_ctrl().

Reported-by: default avatar <syzbot+7c2bb71996f95a82524c@syzkaller.appspotmail.com>
Signed-off-by: default avatarAnirudh Rayabharam <mail@anirudhrb.com>
Acked-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 48e33bef

drivers/hid/usbhid/hid-core.c

+1 −1
Original line number Diff line number Diff line
@@ -374,7 +374,7 @@ static int hid_submit_ctrl(struct hid_device *hid) 
	raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report;

	dir = usbhid->ctrl[usbhid->ctrltail].dir;



	len = ((report->size - 1) >> 3) + 1 + (report->id > 0);

	len = hid_report_len(report);

	if (dir == USB_DIR_OUT) {

		usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0);

		usbhid->urbctrl->transfer_buffer_length = len;

include/linux/hid.h

+1 −2
Original line number Diff line number Diff line
@@ -1167,8 +1167,7 @@ static inline void hid_hw_wait(struct hid_device *hdev) 
 */

static inline u32 hid_report_len(struct hid_report *report)

{

	/* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */

	return ((report->size - 1) >> 3) + 1 + (report->id > 0);

	return DIV_ROUND_UP(report->size, 8) + (report->id > 0);

}



int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,