diff options
Diffstat (limited to '0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch')
| -rw-r--r-- | 0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch | 55 |
1 files changed, 0 insertions, 55 deletions
diff --git a/0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch b/0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch deleted file mode 100644 index c6fe61c40ebb..000000000000 --- a/0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch +++ /dev/null @@ -1,55 +0,0 @@ -From dee1e51b54794e90763e70a3c78f27ba4fa930ec Mon Sep 17 00:00:00 2001 -From: Lee Jones <lee.jones@linaro.org> -Date: Fri, 8 Jul 2022 08:40:09 +0100 -Subject: [PATCH 09/73] HID: steam: Prevent NULL pointer dereference in - steam_{recv,send}_report - -commit cd11d1a6114bd4bc6450ae59f6e110ec47362126 upstream. - -It is possible for a malicious device to forgo submitting a Feature -Report. The HID Steam driver presently makes no prevision for this -and de-references the 'struct hid_report' pointer obtained from the -HID devices without first checking its validity. Let's change that. - -Cc: Jiri Kosina <jikos@kernel.org> -Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> -Cc: linux-input@vger.kernel.org -Fixes: c164d6abf3841 ("HID: add driver for Valve Steam Controller") -Signed-off-by: Lee Jones <lee.jones@linaro.org> -Signed-off-by: Jiri Kosina <jkosina@suse.cz> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ---- - drivers/hid/hid-steam.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c -index a3b151b29bd7..fc616db4231b 100644 ---- a/drivers/hid/hid-steam.c -+++ b/drivers/hid/hid-steam.c -@@ -134,6 +134,11 @@ static int steam_recv_report(struct steam_device *steam, - int ret; - - r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0]; -+ if (!r) { -+ hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); -+ return -EINVAL; -+ } -+ - if (hid_report_len(r) < 64) - return -EINVAL; - -@@ -165,6 +170,11 @@ static int steam_send_report(struct steam_device *steam, - int ret; - - r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0]; -+ if (!r) { -+ hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); -+ return -EINVAL; -+ } -+ - if (hid_report_len(r) < 64) - return -EINVAL; - --- -2.37.3 - |