Kees Cook 875b4e3763 HID: ntrig: validate feature report details ...

A HID device could send a malicious feature report that would cause the
ntrig HID driver to trigger a NULL dereference during initialization:

[57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001
...
[57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig]

CVE-2013-2896

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

2013-09-04 12:00:23 +02:00

..

i2c-hid

HID: i2c-hid: don't push static constants on stack for %*ph

2013-08-05 11:19:38 +02:00

usbhid

HID: usbhid: quirk for N-Trig DuoSense Touch Screen

2013-09-02 13:34:43 +02:00

hid-a4tech.c

…

hid-apple.c

HID: apple: Add support for the 2013 Macbook Air

2013-07-02 20:39:29 -07:00

hid-appleir.c

HID: appleir: add support for Apple ir devices

2013-04-18 19:06:20 -07:00

hid-aureal.c

…

hid-axff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-belkin.c

…

hid-cherry.c

…

hid-chicony.c

…

hid-core.c

Merge branch 'master' into for-3.12/upstream

2013-09-04 10:49:57 +02:00

hid-cypress.c

…

hid-debug.c

HID: debug: fix RCU preemption issue

2013-05-06 13:07:33 +02:00

hid-dr.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-elecom.c

…

hid-elo.c

HID: elo: add quirks for broken firmware

2013-05-29 01:11:43 +02:00

hid-emsff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-ezkey.c

…

hid-gaff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-generic.c

…

hid-gyration.c

…

hid-holtek-kbd.c

…

hid-holtek-mouse.c

HID: holtek-mouse: use module_hid_driver() to simplify the code

2013-05-29 15:04:33 +02:00

hid-holtekff.c

HID: hid-holtekff: don't push static constants on stack for %*ph

2013-08-05 11:29:57 +02:00

hid-huion.c

HID: add support for Huion 580 tablet

2013-05-28 14:29:38 +02:00

hid-hyperv.c

HID: hyperv: convert alloc+memcpy to memdup

2013-06-03 13:32:22 +02:00

hid-icade.c

HID: icade: u16 which never < 0

2013-04-24 16:32:27 +02:00

hid-ids.h

HID: Correct the USB IDs for the new Macbook Air 6

2013-09-04 10:50:41 +02:00

hid-input.c

HID: battery: don't do DMA from stack

2013-09-02 13:43:00 +02:00

hid-kensington.c

…

hid-keytouch.c

…

hid-kye.c

HID: kye: Add report fixup for Genius Gx Imperator Keyboard

2013-07-15 10:25:33 +02:00

hid-lcpower.c

…

hid-lenovo-tpkbd.c

Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and 'for-3.10/upstream' into for-linus

2013-04-30 10:19:07 +02:00

hid-lg2ff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-lg3ff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-lg4ff.c

Merge branches 'for-3.10/appleir', 'for-3.10/hid-debug', 'for-3.10/hid-driver-transport-cleanups', 'for-3.10/i2c-hid' and 'for-3.10/logitech' into for-linus

2013-04-30 10:12:44 +02:00

hid-lg.c

Merge branches 'for-3.9/logitech', 'for-3.9/multitouch', 'for-3.9/ntrig', 'for-3.9/thingm' and 'for-3.9/upstream' into for-linus

2013-02-21 10:45:01 +01:00

hid-lg.h

…

hid-lgff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-logitech-dj.c

Merge branch 'master' into for-3.12/upstream

2013-09-04 10:49:57 +02:00

hid-logitech-dj.h

HID: Revert "Revert "HID: Fix logitech-dj: missing Unifying device issue""

2013-07-22 16:32:24 +02:00

hid-magicmouse.c

HID: replace strict_strtoul() with kstrtoul()

2013-07-23 16:05:46 +02:00

hid-microsoft.c

HID: Add PID for Japanese version of NE4K keyboard

2013-04-29 10:16:55 +02:00

hid-monterey.c

…

hid-multitouch.c

Merge branches 'for-3.11/multitouch', 'for-3.11/sony' and 'for-3.11/upstream' into for-linus

2013-07-04 15:02:26 +02:00

hid-ntrig.c

HID: ntrig: validate feature report details

2013-09-04 12:00:23 +02:00

hid-ortek.c

…

hid-petalynx.c

…

hid-picolcd_backlight.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-picolcd_cir.c

HID: picolcd: Prevent NULL pointer dereference on _remove()

2013-09-02 13:36:50 +02:00

hid-picolcd_core.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-picolcd_debugfs.c

HID: fix data access in implement()

2013-07-22 16:16:40 +02:00

hid-picolcd_fb.c

HID: picolcd: Prevent NULL pointer dereference on _remove()

2013-09-02 13:36:50 +02:00

hid-picolcd_lcd.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-picolcd_leds.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-picolcd.h

Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and 'for-3.10/upstream' into for-linus

2013-04-30 10:19:07 +02:00

hid-pl.c

HID: pantherlord: validate output report details

2013-09-04 11:58:32 +02:00

hid-primax.c

…

hid-prodikeys.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-roccat-arvo.c

HID: replace strict_strtoul() with kstrtoul()

2013-07-23 16:05:46 +02:00

hid-roccat-arvo.h

…

hid-roccat-common.c

…

hid-roccat-common.h

…

hid-roccat-isku.c

HID: replace strict_strtoul() with kstrtoul()

2013-07-23 16:05:46 +02:00

hid-roccat-isku.h

HID: roccat: add support for IskuFX

2013-03-14 11:50:49 +01:00

hid-roccat-kone.c

HID: replace strict_strtoul() with kstrtoul()

2013-07-23 16:05:46 +02:00

hid-roccat-kone.h

HID: roccat: added media key support for Kone

2013-04-08 10:33:13 +02:00

hid-roccat-koneplus.c

HID: replace strict_strtoul() with kstrtoul()

2013-07-23 16:05:46 +02:00

hid-roccat-koneplus.h

…

hid-roccat-konepure.c

HID: roccat: add support for KonePureOptical v2

2013-09-02 13:38:38 +02:00

hid-roccat-konepure.h

HID: roccat: add support for Roccat Kone Pure gaming mouse

2013-03-14 11:50:49 +01:00

hid-roccat-kovaplus.c

HID: replace strict_strtoul() with kstrtoul()

2013-07-23 16:05:46 +02:00

hid-roccat-kovaplus.h

…

hid-roccat-lua.c

…

hid-roccat-lua.h

…

hid-roccat-pyra.c

…

hid-roccat-pyra.h

…

hid-roccat-savu.c

…

hid-roccat-savu.h

…

hid-roccat.c

HID: roccat: check cdev_add return value

2013-06-18 11:00:36 +02:00

hid-saitek.c

…

hid-samsung.c

…

hid-sensor-hub.c

HID: hid-sensor-hub: fix style of comments

2013-08-26 13:46:11 +02:00

hid-sjoy.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-sony.c

HID: sony: fix HID mapping for PS3 sixaxis controller

2013-07-24 16:57:09 +02:00

hid-speedlink.c

HID: Fix Speedlink VAD Cezanne support for some devices

2013-08-26 13:51:10 +02:00

hid-steelseries.c

HID: hid-steelseries fix led class build issue

2013-05-03 10:26:52 +02:00

hid-sunplus.c

…

hid-thingm.c

HID: Kconfig: Remove explicit transport layer dependencies

2013-02-25 13:26:40 +01:00

hid-tivo.c

…

hid-tmff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-topseed.c

…

hid-twinhan.c

…

hid-uclogic.c

…

hid-wacom.c

HID: wacom: Intuos4 battery charging changes

2013-07-04 15:04:47 +02:00

hid-waltop.c

…

hid-wiimote-core.c

HID: wiimote: support Nintendo Wii U Pro Controller

2013-06-27 11:57:49 +02:00

hid-wiimote-debug.c

HID: wiimote: fix DRM debug-attr to correctly parse input

2013-06-03 11:07:06 +02:00

hid-wiimote-modules.c

HID: wiimote: support Nintendo Wii U Pro Controller

2013-06-27 11:57:49 +02:00

hid-wiimote.h

HID: wiimote: support Nintendo Wii U Pro Controller

2013-06-27 11:57:49 +02:00

hid-xinmo.c

HID: use module_hid_driver() to simplify the code

2013-08-26 13:23:04 +02:00

hid-zpff.c

HID: use hid_hw_request() instead of direct call to usbhid

2013-02-25 13:26:41 +01:00

hid-zydacron.c

…

hidraw.c

Merge branch 'master' into for-3.12/upstream

2013-09-04 10:49:57 +02:00

Kconfig

HID: Add new driver for non-compliant Xin-Mo devices.

2013-07-29 11:49:29 +02:00

Makefile

HID: Add new driver for non-compliant Xin-Mo devices.

2013-07-29 11:49:29 +02:00

uhid.c

HID: uhid: add devname module alias

2013-09-02 13:28:07 +02:00