From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751501AbdJXFaK (ORCPT ); Tue, 24 Oct 2017 01:30:10 -0400 Received: from mail-it0-f53.google.com ([209.85.214.53]:47622 "EHLO mail-it0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750908AbdJXFaI (ORCPT ); Tue, 24 Oct 2017 01:30:08 -0400 X-Google-Smtp-Source: ABhQp+TPBQOvRqqgWc7Cypzw7j8c267drs8WZpZDzLWp4WmhwcdQsFzNAarPbXABTCOqA6cpkAl0jg== Date: Mon, 23 Oct 2017 22:30:05 -0700 From: Dmitry Torokhov To: Andrey Konovalov Cc: linux-input@vger.kernel.org, LKML , Dmitry Vyukov , Kostya Serebryany , syzkaller Subject: Re: usb/input/gtco: slab-out-of-bounds in parse_hid_report_descriptor Message-ID: <20171024053005.gleghx4szbdfoj63@dtor-ws> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20170609 (1.8.3) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Oct 23, 2017 at 01:24:23PM +0200, Andrey Konovalov wrote: > Hi! > > I've got the following report while fuzzing the kernel with syzkaller. > > On commit 3e0cc09a3a2c40ec1ffb6b4e12da86e98feccb11 (4.14-rc5+). > > parse_hid_report_descriptor() has a while (i < length) loop, which > only guarantees that there's at least 1 byte in the buffer, but the > loop body can read multiple bytes which causes out-of-bounds access. Ugh, this whole driver should be moved over to HID, but I am not sure who has hardware to test... I just sent a patch plugging this hole. Thanks for the report. -- Dmitry