Pietro Borrello 350f0fc905 hid: bigben_probe(): validate report count ...

[ Upstream commit b94335f899 ]

bigben_probe() does not validate that the output report has the
needed report values in the first field.
A malicious device registering a report with one field and a single
value causes an head OOB write in bigben_worker() when
accessing report_field->value[1] to report_field->value[7].
Use hid_validate_values() which takes care of all the needed checks.

Fixes: 256a90ed9e ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230211-bigben-oob-v1-1-d2849688594c@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-03-10 09:39:31 +01:00

..

accessibility

…

acpi

ACPI: resource: Do IRQ override on all TongFang GMxRGxx

2023-03-10 09:39:17 +01:00

amba

…

android

binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0

2023-02-25 12:06:45 +01:00

ata

ata: libata: Fix sata_down_spd_limit() when no link speed is reported

2023-02-09 11:26:37 +01:00

atm

…

auxdisplay

…

base

…

bcma

…

block

nbd: fix possible overflow on 'first_minor' in nbd_dev_add()

2023-02-25 12:06:45 +01:00

bluetooth

Bluetooth: hci_qca: get wakeup status from serdev device handle

2023-03-10 09:39:15 +01:00

bus

…

cdrom

…

char

…

clk

clk: mxl: syscon_node_to_regmap() returns error pointers

2023-02-25 12:06:43 +01:00

clocksource

…

comedi

…

connector

…

counter

…

cpufreq

…

cpuidle

…

crypto

crypto: crypto4xx - Call dma_unmap_page when done

2023-03-10 09:39:17 +01:00

cxl

…

dax

…

dca

…

devfreq

…

dio

…

dma

…

dma-buf

…

edac

…

eisa

…

extcon

…

firewire

…

firmware

efi: Accept version 2 of memory attributes table

2023-02-09 11:26:41 +01:00

fpga

fpga: stratix10-soc: Fix return value check in s10_ops_write_init()

2023-02-09 11:26:44 +01:00

fsi

…

gnss

…

gpio

gpio: vf610: connect GPIO label to dev name

2023-03-10 09:39:27 +01:00

gpu

drm/amdgpu: fix enum odm_combine_mode mismatch

2023-03-10 09:39:28 +01:00

greybus

…

hid

hid: bigben_probe(): validate report count

2023-03-10 09:39:31 +01:00

hsi

…

hv

…

hwmon

hwmon: (mlxreg-fan) Return zero speed for broken fan

2023-03-10 09:39:30 +01:00

hwspinlock

…

hwtracing

…

i2c

i2c: rk3x: fix a bunch of kernel-doc warnings

2023-02-09 11:26:39 +01:00

i3c

…

idle

…

iio

iio:adc:twl6030: Enable measurement of VAC

2023-02-09 11:26:47 +01:00

infiniband

IB/hfi1: Assign npages earlier

2023-03-03 11:45:52 +01:00

input

Input: i8042 - add Clevo PCX0DX to i8042 quirk table

2023-02-09 11:26:41 +01:00

interconnect

…

iommu

…

ipack

…

irqchip

irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts

2023-03-10 09:39:18 +01:00

isdn

…

leds

leds: led-class: Add missing put_device() to led_put()

2023-03-10 09:39:13 +01:00

macintosh

…

mailbox

…

mcb

…

md

dm: remove flush_scheduled_work() during local_exit()

2023-03-10 09:39:30 +01:00

media

…

memory

…

memstick

…

message

…

mfd

…

misc

…

mmc

mmc: mmc_spi: fix error handling in mmc_spi_probe()

2023-02-22 12:57:06 +01:00

most

…

mtd

…

mux

…

net

net: bcmgenet: fix MoCA LED control

2023-03-10 09:39:19 +01:00

nfc

…

ntb

…

nubus

…

nvdimm

…

nvme

nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association

2023-02-22 12:57:02 +01:00

nvmem

nvmem: core: fix return value

2023-02-22 12:57:03 +01:00

of

of: reserved_mem: Have kmemleak ignore dynamically allocated reserved mem

2023-02-22 12:57:07 +01:00

opp

OPP: fix error checking in opp_migrate_dentry()

2023-03-10 09:39:15 +01:00

parisc

…

parport

…

pci

…

pcmcia

…

perf

…

phy

phy: qcom-qmp-combo: fix runtime suspend

2023-02-09 11:26:46 +01:00

pinctrl

pinctrl: mediatek: Initialize variable *buf to zero

2023-03-10 09:39:25 +01:00

platform

platform/x86/amd: pmc: add CONFIG_SERIO dependency

2023-02-22 12:57:11 +01:00

pnp

…

power

…

powercap

powercap: fix possible name leak in powercap_register_zone()

2023-03-10 09:39:12 +01:00

pps

…

ps3

…

ptp

…

pwm

…

rapidio

…

ras

…

regulator

…

remoteproc

…

reset

…

rpmsg

…

rtc

…

s390

s390/dasd: Fix potential memleak in dasd_eckd_init()

2023-03-10 09:39:04 +01:00

sbus

…

scsi

scsi: aic94xx: Add missing check for dma_map_single()

2023-03-10 09:39:28 +01:00

sh

…

siox

…

slimbus

…

soc

…

soundwire

…

spi

spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()

2023-03-10 09:39:31 +01:00

spmi

…

ssb

…

staging

staging: mt7621-dts: change palmbus address to lower case

2023-03-03 11:45:53 +01:00

target

scsi: target: core: Fix warning on RT kernels

2023-02-09 11:26:39 +01:00

tc

…

tee

…

thermal

thermal/drivers/hisi: Drop second sensor hi3660

2023-03-10 09:39:18 +01:00

thunderbolt

…

tty

vc_screen: don't clobber return value in vcs_read

2023-03-03 11:45:53 +01:00

uio

…

usb

USB: core: Don't hold device lock while reading the "descriptors" sysfs file

2023-03-03 11:45:54 +01:00

vdpa

…

vfio

…

vhost

…

video

fbdev: smscufx: fix error handling code in ufx_usb_probe

2023-02-09 11:26:47 +01:00

virt

…

virtio

…

visorbus

…

vlynq

…

vme

…

w1

…

watchdog

watchdog: diag288_wdt: fix __diag288() inline assembly

2023-02-09 11:26:41 +01:00

xen

…

zorro

…

Kconfig

…

Makefile

…