UPSTREAM: HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
commit d93ba918a185aca2594da63e92fdc5495b559c0f upstream.
It is currently possible for a malicious or misconfigured USB device to
cause an out-of-bounds (OOB) read when submitting reports using
DOUBLE_REPORT_ID by specifying a large report length and providing a
smaller one.
Let's prevent that by comparing the specified report length with the
actual size of the data read in from userspace. If the actual data
length ends up being smaller than specified, we'll politely warn the
user and prevent any further processing.
Bug: 508702402
Signed-off-by: Lee Jones <[email protected]>
Reviewed-by: Günther Noack <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
(cherry picked from commit ace7fc4d38799c6dbc2b79d7e7587196bd61964c)
Signed-off-by: Lee Jones <[email protected]>
Change-Id: Idc6397ff34d06bea3df244ac532414ba23cf7705
1 file changed
