raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

Input: pegasus-notetaker - fix potential out-of-bounds access

Browse Source 
commit 69aeb50731 upstream.

In the pegasus_notetaker driver, the pegasus_probe() function allocates
the URB transfer buffer using the wMaxPacketSize value from
the endpoint descriptor. An attacker can use a malicious USB descriptor
to force the allocation of a very small buffer.

Subsequently, if the device sends an interrupt packet with a specific
pattern (e.g., where the first byte is 0x80 or 0x42),
the pegasus_parse_packet() function parses the packet without checking
the allocated buffer size. This leads to an out-of-bounds memory access.

Fixes: 1afca2b66a ("Input: add Pegasus Notetaker tablet driver")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Seungjin Bae
2025-10-17 15:36:31 -07:00
committed by Greg Kroah-Hartman
parent 6524a15d33
commit 763c3f4d23
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/input/tablet/pegasus_notetaker.c
View File

@@ -63,6 +63,9 @@
#define BUTTON_PRESSED 0xb5 #define BUTTON_PRESSED 0xb5
#define COMMAND_VERSION 0xa9 #define COMMAND_VERSION 0xa9
/* 1 Status + 1 Color + 2 X + 2 Y = 6 bytes */
#define NOTETAKER_PACKET_SIZE 6
/* in xy data packet */ /* in xy data packet */
#define BATTERY_NO_REPORT 0x40 #define BATTERY_NO_REPORT 0x40
#define BATTERY_LOW 0x41 #define BATTERY_LOW 0x41
@@ -311,6 +314,12 @@ static int pegasus_probe(struct usb_interface *intf,
} }
pegasus->data_len = usb_maxpacket(dev, pipe); pegasus->data_len = usb_maxpacket(dev, pipe);
if (pegasus->data_len < NOTETAKER_PACKET_SIZE) {
dev_err(&intf->dev, "packet size is too small (%d)\n",
pegasus->data_len);
error = -EINVAL;
goto err_free_mem;
}
pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL, pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL,
&pegasus->data_dma); &pegasus->data_dma);