Re: [PATCH v2 RESEND] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
Jiri Kosina <[email protected]>
| Newsgroups | org.kernel.vger.linux-iio,org.kernel.vger.linux-input |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 5 Aug 2026, bakabaka9 wrote: > From: Xingrui Li <[email protected]> > > sensor_hub_get_feature() clamps its return value to the caller's buffer > size, but the copy loop still copies field->report_size / 8 bytes for > each report value. A malicious HID descriptor can advertise a large > feature field size while an IIO caller supplies a small stack buffer, > such as a single s32, causing an out-of-bounds write. > > HID core stores parsed report values in __s32 slots and clamps extracted > values to 32 bits. Reject feature fields that require more than one slot > per value, guard the total byte count calculation, and clamp each > per-value copy to the remaining caller buffer. > > Fixes: 5459ada2b3cd69 ("HID: sensor-hub: Fix packing of result buffer for feature report") > Cc: [email protected] > Assisted-by: OpenAI:GPT-5.5-Cyber > Signed-off-by: Xingrui Li <[email protected]> Applied, thanks. -- Jiri Kosina SUSE Labs