Tetsuo Handa fdd57c20d4 Input: iforce - invert valid length check when fetching device IDs ...

commit b8ebf25099 upstream.

syzbot is reporting uninitialized value at iforce_init_device() [1], for
commit 6ac0aec6b0 ("Input: iforce - allow callers supply data buffer
when fetching device IDs") is checking that valid length is shorter than
bytes to read. Since iforce_get_id_packet() stores valid length when
returning 0, the caller needs to check that valid length is longer than or
equals to bytes to read.

Reported-by: syzbot <syzbot+4dd880c1184280378821@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6ac0aec6b0 ("Input: iforce - allow callers supply data buffer when fetching device IDs")
Link: https://lore.kernel.org/r/531fb432-7396-ad37-ecba-3e42e7f56d5c@I-love.SAKURA.ne.jp
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2022-11-26 09:24:47 +01:00

..

gameport

bus: Make remove callback return void

2021-07-21 11:53:42 +02:00

joystick

Input: iforce - invert valid length check when fetching device IDs

2022-11-26 09:24:47 +01:00

keyboard

Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address

2022-10-05 10:39:37 +02:00

misc

Input: rk805-pwrkey - fix module autoloading

2022-09-08 12:28:05 +02:00

mouse

Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag

2022-06-14 18:36:26 +02:00

rmi4

Input: synaptics-rmi4 - use new structure for SPI transfer delays

2020-12-10 23:39:16 -08:00

serio

Input: i8042 - add additional TUXEDO devices to i8042 quirk tables

2022-08-31 17:16:35 +02:00

tablet

Input: aiptek - properly check endpoint type

2022-03-23 09:16:43 +01:00

touchscreen

Input: melfas_mip4 - fix return value check in mip4_probe()

2022-10-05 10:39:42 +02:00

apm-power.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

evbug.c

Input: evbug - remove an empty comment block

2021-05-24 21:06:39 -07:00

evdev.c

Input: evdev - per-client waitgroups

2020-10-06 18:34:15 -07:00

ff-core.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156

2019-05-30 11:26:35 -07:00

ff-memless.c

Input: ff-memless - kill timer in destroy()

2019-11-15 11:45:03 -08:00

input-compat.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

input-compat.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

input-leds.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

input-mt.c

Input: MT - avoid comma separated statements

2020-08-25 10:26:05 -07:00

input-poller.c

Input: use input_device_enabled()

2020-12-02 22:10:33 -08:00

input-poller.h

Input: add support for polling to input devices

2019-08-20 12:04:07 -07:00

input.c

Input: add bounds checking to input_set_capability()

2022-05-25 09:57:24 +02:00

joydev.c

Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl

2021-07-04 23:02:10 -07:00

Kconfig

um: allow disabling NO_IOMEM

2021-06-17 21:44:50 +02:00

Makefile

Input: touchscreen - move helper functions to core

2021-03-25 11:14:09 -07:00

matrix-keymap.c

Input: matrix-keymap - switch to use device_property_count_u32()

2019-08-12 00:03:13 -07:00

mousedev.c

*: convert stream-like files -> stream_open, even if they use noop_llseek

2019-07-14 16:09:19 +03:00

sparse-keymap.c

Input: Use fallthrough pseudo-keyword

2020-07-07 11:25:54 -07:00

touchscreen.c

Input: touchscreen - avoid bitwise vs logical OR warning

2021-10-15 22:22:54 -07:00