HID: hid-input: clear unmapped usages
We should not be leaving half-mapped usages with potentially invalid keycodes, as that may confuse hidinput_find_key() when the key is located by index, which may end up feeding way too large keycode into the VT keyboard handler and cause OOB write there: BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline] BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722 ... kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118 input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145 input_pass_values drivers/input/input.c:949 [inline] input_set_keycode+0x290/0x320 drivers/input/input.c:954 evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882 evdev_do_ioctl drivers/input/evdev.c:1150 [inline] Cc: stable@vger.kernel.org Reported-by:<syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com> Signed-off-by:
Dmitry Torokhov <dmitry.torokhov@gmail.com> Tested-by:
Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by:
Jiri Kosina <jkosina@suse.cz>
Loading
-
mentioned in commit 817009b4
-
mentioned in commit 2fc1747e
-
mentioned in commit 466233b7
-
mentioned in commit c5360510
-
mentioned in commit 78b812b9
-
mentioned in commit 88d56085
-
mentioned in commit ada2bf8b
-
mentioned in commit be085444
-
mentioned in commit b1f7218a
-
mentioned in commit 97b2daec
-
mentioned in commit 7d22bace
-
mentioned in commit 87cea96f
Please sign in to comment