github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

HID: logitech-dj: validate unnumbered keyboard reports

Browse Source 
The HID core invokes raw_event callbacks before validating the report
length.  For an unnumbered keyboard report, logi_dj_raw_event() uses the
second byte as temporary storage while prepending a report ID.  A one-byte
report therefore makes both the initial write and the later restoration
access data beyond the received report.

Reject unnumbered keyboard reports that do not provide the temporary byte.

Commit 47669bec44 ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.

Fixes: 74808f9115 ("HID: logitech-dj: add support for non unifying receivers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Jiale Yao 2026-09-24 22:44:08 +08:00 committed by Jiri Kosina
parent 1cb92fcb2a
commit c2deafcb4c
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/hid/hid-logitech-dj.c
View File

@ -1790,6 +1790,9 @@ static int logi_dj_raw_event(struct hid_device *hdev,
if (!hdev->report_enum[HID_INPUT_REPORT].numbered) {
if (djrcv_dev->unnumbered_application == HID_GD_KEYBOARD) {
if (size < 2)
return false;
/*
* For the keyboard, we can reuse the same report by
* using the second byte which is constant in the USB