OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/drivers/hid
History
Kees Cook 9446edb9a1 HID: sony: validate HID output report details 
This driver must validate the availability of the HID output report and
its size before it can write LED states via buzz_set_leds(). This stops
a heap overflow that is possible if a device provides a malicious HID
output report:

[  108.171280] usb 1-1: New USB device found, idVendor=054c, idProduct=0002
...
[  117.507877] BUG kmalloc-192 (Not tainted): Redzone overwritten

CVE-2013-2890

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org #3.11
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
 		2013-09-13 15:12:12 +02:00
..
i2c-hid Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus 2013-09-06 11:58:37 +02:00
usbhid Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus 2013-09-06 11:58:37 +02:00
Kconfig HID: Add new driver for non-compliant Xin-Mo devices. 2013-07-29 11:49:29 +02:00
Makefile HID: Add new driver for non-compliant Xin-Mo devices. 2013-07-29 11:49:29 +02:00
hid-a4tech.c HID: trivial devm conversion for special hid drivers 2013-07-31 10:12:28 +02:00
hid-apple.c Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus 2013-09-06 11:58:37 +02:00
hid-appleir.c HID: appleir: add support for Apple ir devices 2013-04-18 19:06:20 -07:00
hid-aureal.c
…
hid-axff.c
…
hid-belkin.c
…
hid-cherry.c
…
hid-chicony.c
…
hid-core.c HID: provide a helper for validating hid reports 2013-09-13 15:11:21 +02:00
hid-cypress.c
…
hid-debug.c HID: debug: fix RCU preemption issue 2013-05-06 13:07:33 +02:00
hid-dr.c
…
hid-elecom.c
…
hid-elo.c HID: elo: add quirks for broken firmware 2013-05-29 01:11:43 +02:00
hid-emsff.c
…
hid-ezkey.c
…
hid-gaff.c
…
hid-generic.c
…
hid-gyration.c
…
hid-holtek-kbd.c
…
hid-holtek-mouse.c HID: holtek-mouse: use module_hid_driver() to simplify the code 2013-05-29 15:04:33 +02:00
hid-holtekff.c HID: hid-holtekff: don't push static constants on stack for %*ph 2013-08-05 11:29:57 +02:00
hid-huion.c HID: add support for Huion 580 tablet 2013-05-28 14:29:38 +02:00
hid-hyperv.c Drivers: hv: remove HV_DRV_VERSION 2013-08-02 11:34:30 +08:00
hid-icade.c HID: icade: u16 which never < 0 2013-04-24 16:32:27 +02:00
hid-ids.h HID: Correct the USB IDs for the new Macbook Air 6 2013-09-04 10:50:41 +02:00
hid-input.c Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus 2013-09-06 11:58:37 +02:00
hid-kensington.c
…
hid-keytouch.c
…
hid-kye.c HID: kye: Add report fixup for Genius Gx Imperator Keyboard 2013-07-15 10:25:33 +02:00
hid-lcpower.c
…
hid-lenovo-tpkbd.c Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and 'for-3.10/upstream' into for-linus 2013-04-30 10:19:07 +02:00
hid-lg.c
…
hid-lg.h
…
hid-lg2ff.c
…
hid-lg3ff.c
…
hid-lg4ff.c Merge branches 'for-3.10/appleir', 'for-3.10/hid-debug', 'for-3.10/hid-driver-transport-cleanups', 'for-3.10/i2c-hid' and 'for-3.10/logitech' into for-linus 2013-04-30 10:12:44 +02:00
hid-lgff.c
…
hid-logitech-dj.c Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus 2013-09-06 11:58:37 +02:00
hid-logitech-dj.h HID: Revert "Revert "HID: Fix logitech-dj: missing Unifying device issue"" 2013-07-22 16:32:24 +02:00
hid-magicmouse.c Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus 2013-09-06 11:58:37 +02:00
hid-microsoft.c HID: Add PID for Japanese version of NE4K keyboard 2013-04-29 10:16:55 +02:00
hid-monterey.c
…
hid-multitouch.c HID: do not init input reports for Win 8 multitouch devices 2013-08-27 10:00:00 +02:00
hid-ntrig.c HID: ntrig: validate feature report details 2013-09-04 12:00:23 +02:00
hid-ortek.c
…
hid-petalynx.c
…
hid-picolcd.h Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and 'for-3.10/upstream' into for-linus 2013-04-30 10:19:07 +02:00
hid-picolcd_backlight.c
…
hid-picolcd_cir.c HID: picolcd: Prevent NULL pointer dereference on _remove() 2013-09-02 13:36:50 +02:00
hid-picolcd_core.c HID: picolcd_core: validate output report details 2013-09-04 12:03:27 +02:00
hid-picolcd_debugfs.c HID: fix data access in implement() 2013-07-22 16:16:40 +02:00
hid-picolcd_fb.c HID: picolcd: Prevent NULL pointer dereference on _remove() 2013-09-02 13:36:50 +02:00
hid-picolcd_lcd.c
…
hid-picolcd_leds.c
…
hid-pl.c HID: pantherlord: validate output report details 2013-09-04 11:58:32 +02:00
hid-primax.c
…
hid-prodikeys.c
…
hid-roccat-arvo.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-09-06 09:30:36 -07:00
hid-roccat-arvo.h
…
hid-roccat-common.c
…
hid-roccat-common.h
…
hid-roccat-isku.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-09-06 09:30:36 -07:00
hid-roccat-isku.h
…
hid-roccat-kone.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-09-06 09:30:36 -07:00
hid-roccat-kone.h HID: roccat: added media key support for Kone 2013-04-08 10:33:13 +02:00
hid-roccat-koneplus.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-09-06 09:30:36 -07:00
hid-roccat-koneplus.h
…
hid-roccat-konepure.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-09-06 09:30:36 -07:00
hid-roccat-konepure.h
…
hid-roccat-kovaplus.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-09-06 09:30:36 -07:00
hid-roccat-kovaplus.h
…
hid-roccat-lua.c
…
hid-roccat-lua.h
…
hid-roccat-pyra.c hid: roccat-pyra: convert class code to use bin_attrs in groups 2013-08-20 16:59:00 -07:00
hid-roccat-pyra.h
…
hid-roccat-savu.c hid: roccat-savu: convert class code to use bin_attrs in groups 2013-08-19 21:46:53 -07:00
hid-roccat-savu.h
…
hid-roccat.c HID: roccat: check cdev_add return value 2013-06-18 11:00:36 +02:00
hid-saitek.c
…
hid-samsung.c
…
hid-sensor-hub.c Merge branch 'for-3.12/sensor-hub' into for-linus 2013-09-06 11:59:53 +02:00
hid-sjoy.c
…
hid-sony.c HID: sony: validate HID output report details 2013-09-13 15:12:12 +02:00
hid-speedlink.c HID: Fix Speedlink VAD Cezanne support for some devices 2013-08-26 13:51:10 +02:00
hid-steelseries.c HID: hid-steelseries fix led class build issue 2013-05-03 10:26:52 +02:00
hid-sunplus.c
…
hid-thingm.c
…
hid-tivo.c
…
hid-tmff.c
…
hid-topseed.c
…
hid-twinhan.c
…
hid-uclogic.c
…
hid-wacom.c HID: wacom: Intuos4 battery charging changes 2013-07-04 15:04:47 +02:00
hid-waltop.c
…
hid-wiimote-core.c Revert "Input: introduce BTN/ABS bits for drums and guitars" 2013-09-07 09:48:41 -07:00
hid-wiimote-debug.c HID: wiimote: fix DRM debug-attr to correctly parse input 2013-06-03 11:07:06 +02:00
hid-wiimote-modules.c Revert "Input: introduce BTN/ABS bits for drums and guitars" 2013-09-07 09:48:41 -07:00
hid-wiimote.h Revert "Input: introduce BTN/ABS bits for drums and guitars" 2013-09-07 09:48:41 -07:00
hid-xinmo.c HID: use module_hid_driver() to simplify the code 2013-08-26 13:23:04 +02:00
hid-zpff.c HID: zeroplus: validate output report details 2013-09-13 15:11:34 +02:00
hid-zydacron.c HID: trivial devm conversion for special hid drivers 2013-07-31 10:12:28 +02:00
hidraw.c Merge branch 'master' into for-3.12/upstream 2013-09-04 10:49:57 +02:00
uhid.c Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus 2013-09-06 11:58:37 +02:00