Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1214997

[PATCH 3.19.y-ckt 016/130] Input: zforce - don't overwrite the stack

Show all headers | View raw

3.19.8-ckt6 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>

commit 7d01cd261c76f95913c81554a751968a1d282d3a upstream.

If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we
will silently overwrite the stack.

Signed-off-by: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>
Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/input/touchscreen/zforce_ts.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index 19880c7..a9e1ee3 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -430,7 +430,7 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
 		goto unlock;
 	}
 
-	if (buf[PAYLOAD_LENGTH] == 0) {
+	if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
 		dev_err(&client->dev, "invalid payload length: %d\n",
 			buf[PAYLOAD_LENGTH]);
 		ret = -EIO;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt6 stable review Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 005/130] ata: pmp: add quirk for Marvell 4140 SATA PMP Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 013/130] NET: AX.25: Stop heartbeat timer on disconnect. Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
    Re: [PATCH 3.19.y-ckt 013/130] NET: AX.25: Stop heartbeat timer on  disconnect. Richard Stearn <richard@rns-stearn.demon.co.uk> - 2015-08-28 11:00 +0200
      Re: [PATCH 3.19.y-ckt 013/130] NET: AX.25: Stop heartbeat timer on  disconnect. Kamal Mostafa <kamal@canonical.com> - 2015-08-28 23:10 +0200
  [PATCH 3.19.y-ckt 012/130] libata: increase the timeout when setting transfer mode Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 007/130] efi: Handle memory error structures produced based on old versions of standard Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 011/130] libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 004/130] HID: cp2112: fix to force single data-report reply Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 016/130] Input: zforce - don't overwrite the stack Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 008/130] phy: berlin-usb: fix divider for BG2CD Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200
  [PATCH 3.19.y-ckt 003/130] iwlwifi: mvm: fix antenna selection when BT is active Kamal Mostafa <kamal@canonical.com> - 2015-08-28 01:00 +0200

csiph-web