linux-stable/drivers/hid
Pietro Borrello 28fc6095da HID: betop: check shape of output reports
[ Upstream commit 3782c0d6ed ]

betopff_init() only checks the total sum of the report counts for each
report field to be at least 4, but hid_betopff_play() expects 4 report
fields.
A device advertising an output report with one field and 4 report counts
would pass the check but crash the kernel with a NULL pointer dereference
in hid_betopff_play().

Fixes: 52cd7785f3 ("HID: betop: add drivers/hid/hid-betopff.c")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-01 08:23:15 +01:00
..
i2c-hid HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports 2022-04-08 14:40:15 +02:00
intel-ish-hid HID: intel_ish-hid: Add check for ishtp_dma_tx_map 2023-02-01 08:23:09 +01:00
usbhid HID: usbhid: free raw_report buffers in usbhid_stop 2021-10-06 15:56:03 +02:00
hid-a4tech.c HID: a4tech: use A4_2WHEEL_MOUSE_HACK_B8 for A4TECH NB-95 2021-06-18 10:00:03 +02:00
hid-accutouch.c
hid-alps.c HID: alps: Declare U1_UNICORN_LEGACY support 2022-08-21 15:16:01 +02:00
hid-apple.c HID: apple: Do not reset quirks when the Fn key is not found 2022-01-27 10:54:11 +01:00
hid-appleir.c HID: appleir: Use devm_kzalloc() instead of kzalloc() 2020-03-13 17:33:11 +01:00
hid-asus.c HID: add hid_is_usb() function to make it simpler for USB detection 2021-12-14 11:32:33 +01:00
hid-aureal.c
hid-axff.c
hid-belkin.c
hid-betopff.c HID: betop: check shape of output reports 2023-02-01 08:23:15 +01:00
hid-bigbenff.c HID: check empty report_list in bigben_probe() 2023-02-01 08:23:13 +01:00
hid-cherry.c
hid-chicony.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-cmedia.c
hid-core.c HID: check empty report_list in hid_validate_values() 2023-02-01 08:23:13 +01:00
hid-corsair.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-cougar.c HID: cougar: Constify cougar_id_table 2020-08-17 11:38:49 +02:00
hid-cp2112.c HID: cp2112: prevent a buffer overflow in cp2112_xfer() 2022-08-21 15:15:53 +02:00
hid-creative-sb0540.c
hid-cypress.c HID: cypress: Support Varmilo Keyboards' media hotkeys 2020-10-23 13:23:44 +02:00
hid-debug.c HID: add mapping for KEY_ALL_APPLICATIONS 2022-03-08 19:09:38 +01:00
hid-dr.c
hid-elan.c HID: elan: Fix potential double free in elan_input_configured 2022-06-09 10:21:02 +02:00
hid-elecom.c
hid-elo.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-emsff.c
hid-ezkey.c
hid-gaff.c
hid-gembird.c
hid-generic.c
hid-gfrm.c
hid-glorious.c HID: Add driver fixing Glorious PC Gaming Race mouse report descriptor 2020-03-18 13:36:21 +01:00
hid-google-hammer.c HID: google: add eel USB id 2021-12-14 11:32:33 +01:00
hid-gt683r.c HID: gt683r: add missing MODULE_DEVICE_TABLE 2021-06-18 10:00:04 +02:00
hid-gyration.c
hid-holtek-kbd.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-holtek-mouse.c HID: holtek: fix mouse probing 2021-12-29 12:25:54 +01:00
hid-holtekff.c
hid-hyperv.c HID: hyperv: fix possible memory leak in mousevsc_probe() 2022-11-16 09:57:08 +01:00
hid-icade.c
hid-ids.h HID: revert CHERRY_MOUSE_000C quirk 2023-02-01 08:23:13 +01:00
hid-input.c HID: hid-input: add Surface Go battery quirk 2022-08-21 15:16:15 +02:00
hid-ite.c HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 2022-12-21 17:32:07 +01:00
hid-jabra.c
hid-kensington.c
hid-keytouch.c
hid-kye.c
hid-lcpower.c
hid-led.c HID: hid-led: fix maximum brightness for Dream Cheeky 2022-06-09 10:21:02 +02:00
hid-lenovo.c HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE 2021-05-14 09:50:33 +02:00
hid-lg-g15.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
hid-lg.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-lg.h
hid-lg2ff.c
hid-lg3ff.c
hid-lg4ff.c HID: hid-lg4ff: Add check for empty lbuf 2022-12-14 11:31:59 +01:00
hid-lg4ff.h
hid-lgff.c
hid-logitech-dj.c HID: logitech-dj: add new lightspeed receiver id 2022-04-08 14:39:47 +02:00
hid-logitech-hidpp.c HID: logitech-hidpp: initialize level variable 2021-06-10 13:39:15 +02:00
hid-macally.c HID: macally: Constify macally_id_table 2020-08-17 11:38:49 +02:00
hid-magicmouse.c HID: magicmouse: Do not set BTN_MOUSE on double report 2022-10-30 09:41:16 +01:00
hid-maltron.c
hid-mcp2221.c HID: mcp2221: don't connect hidraw 2023-01-14 10:16:23 +01:00
hid-mf.c HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter 2021-03-11 14:17:24 +01:00
hid-microsoft.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 2020-09-02 12:55:46 -07:00
hid-monterey.c
hid-multitouch.c HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint 2023-01-14 10:16:26 +01:00
hid-nti.c
hid-ntrig.c
hid-ortek.c
hid-penmount.c
hid-petalynx.c
hid-picolcd.h
hid-picolcd_backlight.c
hid-picolcd_cir.c media: rc: harmonize infrared durations to microseconds 2020-09-03 16:18:55 +02:00
hid-picolcd_core.c
hid-picolcd_debugfs.c
hid-picolcd_fb.c Merge branch 'for-5.7/appleir' into for-linus 2020-04-01 12:26:12 +02:00
hid-picolcd_lcd.c
hid-picolcd_leds.c
hid-pl.c
hid-plantronics.c HID: plantronics: Additional PIDs for double volume key presses quirk 2023-01-14 10:16:26 +01:00
hid-primax.c
hid-prodikeys.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-quirks.c HID: revert CHERRY_MOUSE_000C quirk 2023-02-01 08:23:13 +01:00
hid-redragon.c
hid-retrode.c
hid-rmi.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2020-10-23 16:16:31 -07:00
hid-roccat-arvo.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-arvo.h
hid-roccat-common.c
hid-roccat-common.h
hid-roccat-isku.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-isku.h
hid-roccat-kone.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-kone.h
hid-roccat-koneplus.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-koneplus.h
hid-roccat-konepure.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-kovaplus.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-kovaplus.h
hid-roccat-lua.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-lua.h
hid-roccat-pyra.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-pyra.h
hid-roccat-ryos.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-savu.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-roccat-savu.h
hid-roccat.c HID: roccat: Fix use-after-free in roccat_read() 2022-10-26 13:25:53 +02:00
hid-saitek.c HID: saitek: add madcatz variant of MMO7 mouse device ID 2022-11-10 18:14:23 +01:00
hid-samsung.c HID: check for valid USB device for many HID drivers 2021-12-14 11:32:34 +01:00
hid-sensor-custom.c HID: hid-sensor-custom: set fixed size for custom attributes 2023-01-14 10:15:31 +01:00
hid-sensor-hub.c HID: hid-sensor-hub: Return error for hid_set_field() failure 2021-06-18 10:00:03 +02:00
hid-sjoy.c
hid-sony.c HID: sony: Fix for broken buttons on DS3 USB dongles 2020-05-26 11:00:49 +02:00
hid-speedlink.c
hid-steam.c HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report 2022-09-05 10:28:55 +02:00
hid-steelseries.c
hid-sunplus.c
hid-tivo.c
hid-tmff.c
hid-topseed.c
hid-twinhan.c
hid-u2fzero.c HID: add hid_is_usb() function to make it simpler for USB detection 2021-12-14 11:32:33 +01:00
hid-uclogic-core.c HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk 2022-12-21 17:32:07 +01:00
hid-uclogic-params.c HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad 2022-01-27 10:54:02 +01:00
hid-uclogic-params.h
hid-uclogic-rdesc.c
hid-uclogic-rdesc.h
hid-udraw-ps3.c HID: udraw-ps3: Replace HTTP links with HTTPS ones 2020-07-20 12:24:41 +02:00
hid-viewsonic.c
hid-vivaldi.c HID: vivaldi: fix sysfs attributes leak 2022-03-16 14:15:56 +01:00
hid-waltop.c
hid-wiimote-core.c HID: wiimote: narrow spinlock range in wiimote_hid_event() 2020-09-07 16:03:51 +02:00
hid-wiimote-debug.c
hid-wiimote-modules.c HID: Wiimote: Treat the d-pad as an analogue stick 2020-06-19 14:17:22 +02:00
hid-wiimote.h HID: Wiimote: Treat the d-pad as an analogue stick 2020-06-19 14:17:22 +02:00
hid-xinmo.c
hid-zpff.c
hid-zydacron.c
hidraw.c HID: hidraw: fix memory leak in hidraw_release() 2022-09-05 10:28:56 +02:00
Kconfig HID: add USB_HID dependancy on some USB HID drivers 2021-12-14 11:32:34 +01:00
Makefile HID: add vivaldi HID driver 2020-09-30 22:44:26 +02:00
uhid.c HID: uhid: Fix worker destroying device without any protection 2022-01-27 10:53:40 +01:00
wacom.h
wacom_sys.c HID: wacom: Ensure bootloader PID is usable in hidraw mode 2023-01-14 10:16:23 +01:00
wacom_wac.c HID: wacom: Ensure bootloader PID is usable in hidraw mode 2023-01-14 10:16:23 +01:00
wacom_wac.h HID: wacom: Ensure bootloader PID is usable in hidraw mode 2023-01-14 10:16:23 +01:00