[PW_SID:1059479] [v2] Bluetooth: HIDP: cap report descriptor size in HID setup#3338
[PW_SID:1059479] [v2] Bluetooth: HIDP: cap report descriptor size in HID setup#3338BluezTestBot wants to merge 2 commits intoworkflowfrom
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
hidp_setup_hid() duplicates the report descriptor from userspace based on req->rd_size. Large values can trigger oversized copies. Do not reject the connection when rd_size exceeds HID_MAX_DESCRIPTOR_SIZE. Instead, cap rd_size in hidp_setup_hid() and use the capped value for memdup_user() and session->rd_size. This keeps compatibility with existing userspace behavior while bounding memory usage in the HID setup path. Signed-off-by: Yufan Chen <ericterminal@gmail.com>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
IncrementalBuild |
github-actions
bot
force-pushed
the
workflow
branch
2 times, most recently
from
f27164a to
e9dd054
Compare
3 participants
From: Yufan Chen ericterminal@gmail.com
hidp_setup_hid() duplicates the report descriptor from userspace based on
req->rd_size. Large values can trigger oversized copies.
Do not reject the connection when rd_size exceeds
HID_MAX_DESCRIPTOR_SIZE. Instead, cap rd_size in hidp_setup_hid()
and use the capped value for memdup_user() and session->rd_size.
This keeps compatibility with existing userspace behavior while
bounding memory usage in the HID setup path.
Signed-off-by: Yufan Chen ericterminal@gmail.com
net/bluetooth/hidp/core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)