[PATCH 3.19.y-ckt 016/130] Input: zforce - don't overwrite the stack

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!weretis.net!feeder4.news.weretis.net!feeder1.news.weretis.net!newsfeed.CARNet.hr!news.spin.it!bofh.it!news.nic.it!robomod
From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.19.y-ckt 016/130] Input: zforce - don't overwrite the stack
Date	Fri, 28 Aug 2015 01:00:02 +0200
Message-ID	<q2dQd-YC-3@gated-at.bofh.it> (permalink)
References	<q2dGx-Mo-3@gated-at.bofh.it>
X-Original-To	linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com
X-Mailer	git-send-email 1.9.1
X-Extended-Stable	3.19
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	40
Organization	linux.* mail to news gateway
X-Original-Cc	Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>, Dirk Behme <dirk.behme@de.bosch.com>, Dmitry Torokhov <dmitry.torokhov@gmail.com>, Kamal Mostafa <kamal@canonical.com>
X-Original-Date	Thu, 27 Aug 2015 15:10:07 -0700
X-Original-Message-ID	<1440713521-5906-17-git-send-email-kamal@canonical.com>
X-Original-References	<1440713521-5906-1-git-send-email-kamal@canonical.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1214997

Show key headers only | View raw

3.19.8-ckt6 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>

commit 7d01cd261c76f95913c81554a751968a1d282d3a upstream.

If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we
will silently overwrite the stack.

Signed-off-by: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>
Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/input/touchscreen/zforce_ts.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index 19880c7..a9e1ee3 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -430,7 +430,7 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
 		goto unlock;
 	}
 
-	if (buf[PAYLOAD_LENGTH] == 0) {
+	if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
 		dev_err(&client->dev, "invalid payload length: %d\n",
 			buf[PAYLOAD_LENGTH]);
 		ret = -EIO;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt6 stable review Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 005/130] ata: pmp: add quirk for Marvell 4140 SATA PMP Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 013/130] NET: AX.25: Stop heartbeat timer on disconnect. Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
    Re: [PATCH 3.19.y-ckt 013/130] NET: AX.25: Stop heartbeat timer on  disconnect. Richard Stearn <richard@rns-stearn.demon.co.uk> - 2015-08-28 11:00 +0200
      Re: [PATCH 3.19.y-ckt 013/130] NET: AX.25: Stop heartbeat timer on  disconnect. Kamal Mostafa <kamal@canonical.com> - 2015-08-28 23:10 +0200
  [PATCH 3.19.y-ckt 012/130] libata: increase the timeout when setting transfer mode Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 007/130] efi: Handle memory error structures produced based on old versions of standard Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 011/130] libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 004/130] HID: cp2112: fix to force single data-report reply Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 016/130] Input: zforce - don't overwrite the stack Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 008/130] phy: berlin-usb: fix divider for BG2CD Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 003/130] iwlwifi: mvm: fix antenna selection when BT is active Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200

csiph-web