summaryrefslogtreecommitdiff
path: root/drivers/hid/hid-u2fzero.c
diff options
context:
space:
mode:
authorAndrej Shadura <andrew.shadura@collabora.co.uk>2021-09-16 19:33:11 +0300
committerJiri Kosina <jkosina@suse.cz>2021-09-22 10:31:18 +0300
commit22d65765f211cc83186fd8b87521159f354c0da9 (patch)
treedf85d4917d37ad3b890e9411d94a1b076b34db86 /drivers/hid/hid-u2fzero.c
parentd46ef750ed58cbeeba2d9a55c99231c30a172764 (diff)
downloadlinux-22d65765f211cc83186fd8b87521159f354c0da9.tar.xz
HID: u2fzero: ignore incomplete packets without data
Since the actual_length calculation is performed unsigned, packets shorter than 7 bytes (e.g. packets without data or otherwise truncated) or non-received packets ("zero" bytes) can cause buffer overflow. Link: https://bugzilla.kernel.org/show_bug.cgi?id=214437 Fixes: 42337b9d4d958("HID: add driver for U2F Zero built-in LED and RNG") Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid/hid-u2fzero.c')
-rw-r--r--drivers/hid/hid-u2fzero.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
index 95e0807878c7..d70cd3d7f583 100644
--- a/drivers/hid/hid-u2fzero.c
+++ b/drivers/hid/hid-u2fzero.c
@@ -198,7 +198,9 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data,
}
ret = u2fzero_recv(dev, &req, &resp);
- if (ret < 0)
+
+ /* ignore errors or packets without data */
+ if (ret < offsetof(struct u2f_hid_msg, init.data))
return 0;
/* only take the minimum amount of data it is safe to take */