mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

HID: hid-steam: Better handling of serial number length 

The second byte of the GET_STRING_ATTRIB report is a length, so we should set
the size of the buffer to be the size we're actually requesting, and only
reject the reply if the length out is nonsensical.

Signed-off-by: Vicki Pfau <vi@endrift.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Vicki Pfau 2023-12-19 19:38:36 -08:00 committed by Jiri Kosina
parent 4f9a5a9769
commit 43565b6788
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/hid/hid-steam.c
View File

@ -274,7 +274,7 @@ enum {
};
/* Other random constants */
#define STEAM_SERIAL_LEN 10
#define STEAM_SERIAL_LEN 0x15
struct steam_device {
struct list_head list;
@ -421,10 +421,10 @@ static int steam_get_serial(struct steam_device *steam)
{
/*
* Send: 0xae 0x15 0x01
* Recv: 0xae 0x15 0x01 serialnumber (10 chars)
* Recv: 0xae 0x15 0x01 serialnumber
*/
int ret = 0;
u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, 0x15, ATTRIB_STR_UNIT_SERIAL};
u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
u8 reply[3 + STEAM_SERIAL_LEN + 1];
mutex_lock(&steam->report_mutex);
@ -434,12 +434,13 @@ static int steam_get_serial(struct steam_device *steam)
ret = steam_recv_report(steam, reply, sizeof(reply));
if (ret < 0)
goto out;
if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] != 0x15 || reply[2] != ATTRIB_STR_UNIT_SERIAL) {
if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] < 1 ||
reply[1] > sizeof(steam->serial_no) || reply[2] != ATTRIB_STR_UNIT_SERIAL) {
ret = -EIO;
goto out;
}
reply[3 + STEAM_SERIAL_LEN] = 0;
strscpy(steam->serial_no, reply + 3, sizeof(steam->serial_no));
strscpy(steam->serial_no, reply + 3, reply[1]);
out:
mutex_unlock(&steam->report_mutex);
return ret;