MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-22 23:13:01 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
0bbbd97a44
linux-yocto/drivers/hid
History
Arnaud Lecomte cb7630e714 hid: fix I2C read buffer overflow in raw_event() for mcp2221 
commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 upstream.

As reported by syzbot, mcp2221_raw_event lacked
validation of incoming I2C read data sizes, risking buffer
overflows in mcp->rxbuf during multi-part transfers.
As highlighted in the DS20005565B spec, p44, we have:
"The number of read-back data bytes to follow in this packet:
from 0 to a maximum of 60 bytes of read-back bytes."
This patch enforces we don't exceed this limit.

Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346
Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Romain Sioen <romain.sioen@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-10-12 12:56:22 +02:00
..
amd-sfh-hid HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() 2024-10-17 15:24:33 +02:00
bpf HID: bpf: actually free hdev memory after attaching a HID-BPF program 2024-02-23 09:24:55 +01:00
i2c-hid HID: i2c-hid: improve i2c_hid_get_report error message 2025-04-10 14:37:37 +02:00
intel-ish-hid HID: intel-ish-hid: Send clock sync message immediately after reset 2025-03-22 12:50:41 -07:00
surface-hid
usbhid HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() 2025-06-19 15:28:44 +02:00
.kunitconfig
hid-a4tech.c
hid-accutouch.c
hid-alps.c
hid-apple.c HID: apple: avoid setting up battery timer for devices without battery 2025-08-28 16:28:32 +02:00
hid-appleir.c HID: appleir: Fix potential NULL dereference at raw event handle 2025-03-13 12:58:23 +01:00
hid-asus.c HID: asus: add support for missing PX series fn keys 2025-10-02 13:42:52 +02:00
hid-aureal.c
hid-axff.c
hid-belkin.c
hid-betopff.c
hid-bigbenff.c
hid-cherry.c
hid-chicony.c
hid-cmedia.c
hid-core.c HID: core: do not bypass hid_hw_raw_request 2025-07-24 08:53:12 +02:00
hid-corsair.c
hid-cougar.c HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup 2024-09-12 11:11:39 +02:00
hid-cp2112.c hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip 2023-11-20 11:59:22 +01:00
hid-creative-sb0540.c
hid-cypress.c
hid-debug.c input: Add support for "Do Not Disturb" 2024-07-25 09:50:44 +02:00
hid-dr.c
hid-elan.c
hid-elecom.c
hid-elo.c
hid-emsff.c
hid-evision.c
hid-ezkey.c
hid-ft260.c
hid-gaff.c
hid-gembird.c
hid-generic.c HID: add per device quirk to force bind to hid-generic 2024-12-14 20:00:00 +01:00
hid-gfrm.c
hid-glorious.c HID: glorious: fix Glorious Model I HID report 2023-12-20 17:01:58 +01:00
hid-google-hammer.c HID: google: fix unused variable warning under !CONFIG_ACPI 2025-03-13 12:58:28 +01:00
hid-google-stadiaff.c
hid-gt683r.c
hid-gyration.c
hid-holtek-kbd.c HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event 2023-09-18 17:13:01 +02:00
hid-holtek-mouse.c
hid-holtekff.c
hid-hyperv.c HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() 2025-06-19 15:28:44 +02:00
hid-icade.c
hid-ids.h HID: logitech: Add ids for G PRO 2 LIGHTSPEED 2025-09-04 15:30:27 +02:00
hid-input-test.c HID: input: rename hidinput_set_battery_charge_status() 2025-09-04 15:30:21 +02:00
hid-input.c HID: input: report battery status changes immediately 2025-09-04 15:30:21 +02:00
hid-ite.c
hid-jabra.c
hid-kensington.c
hid-keytouch.c
hid-kye.c
hid-lcpower.c
hid-led.c
hid-lenovo.c HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 2025-07-17 18:35:21 +02:00
hid-letsketch.c
hid-lg-g15.c
hid-lg.c
hid-lg.h
hid-lg2ff.c
hid-lg3ff.c
hid-lg4ff.c
hid-lg4ff.h
hid-lgff.c
hid-logitech-dj.c HID: logitech: Add ids for G PRO 2 LIGHTSPEED 2025-09-04 15:30:27 +02:00
hid-logitech-hidpp.c HID: logitech: Add ids for G PRO 2 LIGHTSPEED 2025-09-04 15:30:27 +02:00
hid-macally.c
hid-magicmouse.c HID: magicmouse: avoid setting up battery timer when not needed 2025-08-28 16:28:32 +02:00
hid-maltron.c
hid-mcp2200.c HID: mcp2200: added driver for GPIOs of MCP2200 2024-10-17 15:24:31 +02:00
hid-mcp2221.c hid: fix I2C read buffer overflow in raw_event() for mcp2221 2025-10-12 12:56:22 +02:00
hid-megaworld.c
hid-mf.c
hid-microsoft.c
hid-monterey.c
hid-multitouch.c HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() 2025-09-04 15:30:26 +02:00
hid-nintendo.c HID: nintendo: Prevent divide-by-zero on code 2024-01-20 11:51:45 +01:00
hid-nti.c
hid-ntrig.c HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() 2025-09-04 15:30:27 +02:00
hid-nvidia-shield.c HID: nvidia-shield: Add missing check for input_ff_create_memless 2024-06-21 14:38:26 +02:00
hid-ortek.c
hid-penmount.c
hid-petalynx.c
hid-picolcd_backlight.c
hid-picolcd_cir.c
hid-picolcd_core.c
hid-picolcd_debugfs.c
hid-picolcd_fb.c
hid-picolcd_lcd.c
hid-picolcd_leds.c
hid-picolcd.h
hid-pl.c
hid-plantronics.c HID: hid-plantronics: Add mic mute mapping and generalize quirks 2025-04-07 10:06:35 +02:00
hid-playstation.c
hid-primax.c
hid-prodikeys.c
hid-pxrc.c
hid-quirks.c HID: quirks: add support for Legion Go dual dinput modes 2025-09-04 15:30:26 +02:00
hid-razer.c
hid-redragon.c
hid-retrode.c
hid-rmi.c
hid-roccat-arvo.c
hid-roccat-arvo.h
hid-roccat-common.c
hid-roccat-common.h
hid-roccat-isku.c
hid-roccat-isku.h
hid-roccat-kone.c
hid-roccat-kone.h
hid-roccat-koneplus.c
hid-roccat-koneplus.h
hid-roccat-konepure.c
hid-roccat-kovaplus.c
hid-roccat-kovaplus.h
hid-roccat-lua.c
hid-roccat-lua.h
hid-roccat-pyra.c
hid-roccat-pyra.h
hid-roccat-ryos.c
hid-roccat-savu.c
hid-roccat-savu.h
hid-roccat.c
hid-saitek.c
hid-samsung.c
hid-semitek.c
hid-sensor-custom.c
hid-sensor-hub.c HID: hid-sensor-hub: don't use stale platform-data on remove 2025-02-17 09:40:21 +01:00
hid-sigmamicro.c
hid-sjoy.c
hid-sony.c HID: sony: remove duplicate NULL check before calling usb_free_urb() 2023-10-05 12:50:35 +02:00
hid-speedlink.c
hid-steam.c HID: hid-steam: Fix use-after-free when detaching device 2025-03-13 12:58:31 +01:00
hid-steelseries.c HID: steelseries: Fix signedness bug in steelseries_headset_arctis_1_fetch_battery() 2023-09-18 16:44:24 +02:00
hid-sunplus.c
hid-thrustmaster.c HID: thrustmaster: fix memory leak in thrustmaster_interrupts() 2025-05-22 14:12:15 +02:00
hid-tivo.c
hid-tmff.c
hid-topre.c HID: topre: Fix n-key rollover on Realforce R3S TKL boards 2025-03-22 12:50:41 -07:00
hid-topseed.c
hid-twinhan.c
hid-u2fzero.c
hid-uclogic-core-test.c HID: uclogic: Fix a work->entry not empty bug in __queue_work() 2023-11-20 11:59:22 +01:00
hid-uclogic-core.c HID: uclogic: Add NULL check in uclogic_input_configured() 2025-05-22 14:12:15 +02:00
hid-uclogic-params-test.c HID: uclogic: Fix user-memory-access bug in uclogic_params_ugee_v2_init_event_hooks() 2023-11-20 11:59:22 +01:00
hid-uclogic-params.c
hid-uclogic-params.h
hid-uclogic-rdesc-test.c
hid-uclogic-rdesc.c
hid-uclogic-rdesc.h
hid-udraw-ps3.c
hid-universal-pidff.c HID: pidff: Add PERIODIC_SINE_ONLY quirk 2025-04-25 10:45:12 +02:00
hid-viewsonic.c
hid-vivaldi-common.c
hid-vivaldi-common.h
hid-vivaldi.c
hid-vrc2.c
hid-waltop.c
hid-wiimote-core.c
hid-wiimote-debug.c
hid-wiimote-modules.c
hid-wiimote.h
hid-xiaomi.c
hid-xinmo.c
hid-zpff.c
hid-zydacron.c
hidraw.c HID: hidraw: fix a problem of memory leak in hidraw_release() 2024-02-05 20:14:34 +00:00
Kconfig HID: Add hid-universal-pidff driver and supported device ids 2025-04-25 10:45:12 +02:00
Makefile HID: Add hid-universal-pidff driver and supported device ids 2025-04-25 10:45:12 +02:00
uhid.c
wacom_sys.c HID: wacom: fix kobject reference count leak 2025-07-06 11:00:14 +02:00
wacom_wac.c HID: wacom: Add a new Art Pen 2 2025-09-04 15:30:27 +02:00
wacom_wac.h HID: wacom: Do not warn about dropped packets for first packet 2024-10-04 16:29:12 +02:00
wacom.h