HID: core: Sanitize event code and type when mapping input

commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream.

When calling into hid_map_usage(), the passed event code is
blindly stored as is, even if it doesn't fit in the associated bitmap.

This event code can come from a variety of sources, including devices
masquerading as input devices, only a bit more "programmable".

Instead of taking the event code at face value, check that it actually
fits the corresponding bitmap, and if it doesn't:
- spit out a warning so that we know which device is acting up
- NULLify the bitmap pointer so that we catch unexpected uses

Code paths that can make use of untrusted inputs can now check
that the mapping was indeed correct and bail out if not.

Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index e8641ce677e47b9afb3da718d22074ad0d1ba7d8..e3d475f4baf6637377cc96890fd8ea535586c94f 100644 (file)
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1132,6 +1132,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
        }
 
 mapped:
+       /* Mapping failed, bail out */
+       if (!bit)
+               return;
+
        if (device->driver->input_mapped &&
            device->driver->input_mapped(device, hidinput, field, usage,
                                         &bit, &max) < 0) {

diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 39e4da7468e117c5df20f0090dec3c10d3a6f5b2..128d8f4319b9fe8e7ad7600f3e2ed05e6f16b976 100644 (file)
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -864,6 +864,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                        code = BTN_0  + ((usage->hid - 1) & HID_USAGE);
 
                hid_map_usage(hi, usage, bit, max, EV_KEY, code);
+               if (!*bit)
+                       return -1;
                input_set_capability(hi->input, EV_KEY, code);
                return 1;
 

diff --git a/include/linux/hid.h b/include/linux/hid.h
index 875f71132b1425b494ba9eb538f29543cb857753..c7044a14200ea2744f69c589672b2c7e0fe9b6a4 100644 (file)
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -959,34 +959,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) {
  * @max: maximal valid usage->code to consider later (out parameter)
  * @type: input event type (EV_KEY, EV_REL, ...)
  * @c: code which corresponds to this usage and type
+ *
+ * The value pointed to by @bit will be set to NULL if either @type is
+ * an unhandled event type, or if @c is out of range for @type. This
+ * can be used as an error condition.
  */
 static inline void hid_map_usage(struct hid_input *hidinput,
                struct hid_usage *usage, unsigned long **bit, int *max,
-               __u8 type, __u16 c)
+               __u8 type, unsigned int c)
 {
        struct input_dev *input = hidinput->input;
-
-       usage->type = type;
-       usage->code = c;
+       unsigned long *bmap = NULL;
+       unsigned int limit = 0;
 
        switch (type) {
        case EV_ABS:
-               *bit = input->absbit;
-               *max = ABS_MAX;
+               bmap = input->absbit;
+               limit = ABS_MAX;
                break;
        case EV_REL:
-               *bit = input->relbit;
-               *max = REL_MAX;
+               bmap = input->relbit;
+               limit = REL_MAX;
                break;
        case EV_KEY:
-               *bit = input->keybit;
-               *max = KEY_MAX;
+               bmap = input->keybit;
+               limit = KEY_MAX;
                break;
        case EV_LED:
-               *bit = input->ledbit;
-               *max = LED_MAX;
+               bmap = input->ledbit;
+               limit = LED_MAX;
                break;
        }
+
+       if (unlikely(c > limit || !bmap)) {
+               pr_warn_ratelimited("%s: Invalid code %d type %d\n",
+                                   input->name, c, type);
+               *bit = NULL;
+               return;
+       }
+
+       usage->type = type;
+       usage->code = c;
+       *max = limit;
+       *bit = bmap;
 }
 
 /**
@@ -1000,7 +1015,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput,
                __u8 type, __u16 c)
 {
        hid_map_usage(hidinput, usage, bit, max, type, c);
-       clear_bit(c, *bit);
+       if (*bit)
+               clear_bit(usage->code, *bit);
 }
 
 /**