From patchwork Thu Jun 1 02:53:36 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cengiz Can X-Patchwork-Id: 1788728 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=bWDIQfiX; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4QWrLf24L4z20QB for ; Thu, 1 Jun 2023 12:54:01 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1q4YRm-0005Hq-QI; Thu, 01 Jun 2023 02:53:54 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1q4YRl-0005HX-GV for kernel-team@lists.ubuntu.com; Thu, 01 Jun 2023 02:53:53 +0000 Received: from mail-ej1-f71.google.com (mail-ej1-f71.google.com [209.85.218.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 3658B41231 for ; Thu, 1 Jun 2023 02:53:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1685588033; bh=Yo92vQV9yfZibn28rwqelEBb24mV8C/ismT3Lt5y/VA=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=bWDIQfiX9vcQ2OS11hdcF0+rtxjDSjDHe0Qozoi98+Eg74Qds0pIMybEb2/tGso8W BxjlQl1G9OYu6SkD+XqYQTf2I/aopgpdEt8jijKGBcm7J61bd7rl9Xqs+3w+dpfOuj lHhWBXitOprQNmFfk/LoGbld9UWz59jXspfDL9571CsRFPTzmFeqXhh7ZZI88hiYGZ fuVrFfjssEWr+Bbr6VYMFc+7HOZiU0d60Q/TBhg9c9mfjAr0YzXDPHT6XFAguK/uyB 6n09BydBaQnqWcF4XmRzHnFIhED/aNcH8Uxed+M4VRczp7HrUh65ApCLUKeGeaj+W7 iXRtFZoUwCMeQ== Received: by mail-ej1-f71.google.com with SMTP id a640c23a62f3a-9715654ab36so16565666b.0 for ; Wed, 31 May 2023 19:53:53 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685588032; x=1688180032; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Yo92vQV9yfZibn28rwqelEBb24mV8C/ismT3Lt5y/VA=; b=L+9NMxkeTcnPyqP0XLWE0opV6YefROuUHfj7WYU/iOq5IR3u7xVIGumm9LsL225YVk Wdd8qQpAt4lXmBGH8Y5jIOaE5zXtakzlj84LKXL2uaHjS3YVuxzZVyspWC0clAfPsg57 9cYLjJ7c26JkFnCd5rAX5M+QIqiEQy5NByg8I4Q/ge9uqes7oMmlrev3EV82JX90A7mF emDQOh2MZ3Vnd0NVk1Dxzk1bFexLfS4h3cd8JRMogij5ukQKJTPN78Zz04qCg9p7wu1t Ol4E7EZexDmpVt3MGA+Xl9aBO9txMINknCmT7TYoIiHolU2AiyKxLVU8jKiBZRt/Z+sh 619A== X-Gm-Message-State: AC+VfDwppD2Ja2DmUzpYS65u/HeMwNUMOj2x4VBuu3MVKHYKWfTx5E4Q tHP1xnrQkLHkoipLoT2RfiFy/RFdzYPPY2tPetB9GGvcCcHT9lZ7ddOqwwrNyujDy7NQsg8T1n6 pBc4gtrlM4Cwm2PPdH5RamygaG0HoNVh+PspfIrFy4YZtaCEmOOct X-Received: by 2002:a17:907:3e86:b0:95e:d3f5:3d47 with SMTP id hs6-20020a1709073e8600b0095ed3f53d47mr7634098ejc.48.1685588032639; Wed, 31 May 2023 19:53:52 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ54WGbz79ylyBPgDAe+sOhMvKXhtfOawm+86F+j+AVN+MdHlQfTbcRmoR1EfxQU0sHVdC3BeA== X-Received: by 2002:a17:907:3e86:b0:95e:d3f5:3d47 with SMTP id hs6-20020a1709073e8600b0095ed3f53d47mr7634092ejc.48.1685588032331; Wed, 31 May 2023 19:53:52 -0700 (PDT) Received: from localhost ([82.222.124.85]) by smtp.gmail.com with ESMTPSA id jw5-20020a170906e94500b009707fa1c316sm9859554ejb.213.2023.05.31.19.53.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 31 May 2023 19:53:52 -0700 (PDT) From: Cengiz Can To: kernel-team@lists.ubuntu.com Subject: [SRU OEM-5.17, OEM-6.0 PATCH 1/1] HID: check empty report_list in hid_validate_values() Date: Thu, 1 Jun 2023 05:53:36 +0300 Message-Id: <20230601025334.45651-2-cengiz.can@canonical.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230601025334.45651-1-cengiz.can@canonical.com> References: <20230601025334.45651-1-cengiz.can@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Pietro Borrello Add a check for empty report_list in hid_validate_values(). The missing check causes a type confusion when issuing a list_entry() on an empty report_list. The problem is caused by the assumption that the device must have valid report_list. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption. Fixes: 1b15d2e5b807 ("HID: core: fix validation of report id 0") Signed-off-by: Pietro Borrello Signed-off-by: Jiri Kosina CVE-2023-1073 (cherry picked from commit b12fece4c64857e5fab4290bf01b2e0317a88456) Signed-off-by: Cengiz Can --- drivers/hid/hid-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index b7f5566e338d..ca653b35493f 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -993,8 +993,8 @@ struct hid_report *hid_validate_values(struct hid_device *hid, * Validating on id 0 means we should examine the first * report in the list. */ - report = list_entry( - hid->report_enum[type].report_list.next, + report = list_first_entry_or_null( + &hid->report_enum[type].report_list, struct hid_report, list); } else { report = hid->report_enum[type].report_id_hash[id];