Re: [PATCH 12/14] HID: sensor-hub: validate feature report details

2013-09-04 Thread Kees Cook
Jiri, Should this one have been part of the batch you applied? It doesn't use hid_validate_report(). -Kees On Thu, Aug 29, 2013 at 3:03 AM, Mika Westerberg mika.westerb...@linux.intel.com wrote: On Wed, Aug 28, 2013 at 10:31:44PM +0200, Jiri Kosina wrote: From: Kees Cook keesc...@chromium.org

Re: [PATCH 12/14] HID: sensor-hub: validate feature report details

2013-09-04 Thread Jiri Kosina
On Wed, 4 Sep 2013, Kees Cook wrote: Should this one have been part of the batch you applied? It doesn't use hid_validate_report(). It's there [1], I just somehow forgot to send out information mail, sorry for that. [1]

Re: [PATCH 12/14] HID: sensor-hub: validate feature report details

2013-09-04 Thread Kees Cook
On Wed, Sep 4, 2013 at 11:14 AM, Jiri Kosina jkos...@suse.cz wrote: On Wed, 4 Sep 2013, Kees Cook wrote: Should this one have been part of the batch you applied? It doesn't use hid_validate_report(). It's there [1], I just somehow forgot to send out information mail, sorry for that. [1]

Re: [PATCH 12/14] HID: sensor-hub: validate feature report details

2013-08-29 Thread Mika Westerberg
On Wed, Aug 28, 2013 at 10:31:44PM +0200, Jiri Kosina wrote: From: Kees Cook keesc...@chromium.org A HID device could send a malicious feature report that would cause the sensor-hub HID driver to read past the end of heap allocation, leaking kernel memory contents to the caller.

Re: [PATCH 12/14] HID: sensor-hub: validate feature report details

2013-08-29 Thread Srinivas Pandruvada
On 08/28/2013 02:16 PM, Kees Cook wrote: On Wed, Aug 28, 2013 at 1:42 PM, Jiri Kosina jkos...@suse.cz wrote: On Wed, 28 Aug 2013, Srinivas Pandruvada wrote: A HID device could send a malicious feature report that would cause the sensor-hub HID driver to read past the end of heap allocation,

Re: [PATCH 12/14] HID: sensor-hub: validate feature report details

2013-08-29 Thread Kees Cook
On Thu, Aug 29, 2013 at 11:13 AM, Srinivas Pandruvada srinivas.pandruv...@linux.intel.com wrote: On 08/28/2013 02:16 PM, Kees Cook wrote: On Wed, Aug 28, 2013 at 1:42 PM, Jiri Kosina jkos...@suse.cz wrote: On Wed, 28 Aug 2013, Srinivas Pandruvada wrote: A HID device could send a malicious

[PATCH 12/14] HID: sensor-hub: validate feature report details

2013-08-28 Thread Jiri Kosina
From: Kees Cook keesc...@chromium.org A HID device could send a malicious feature report that would cause the sensor-hub HID driver to read past the end of heap allocation, leaking kernel memory contents to the caller. CVE-2013-2898 Signed-off-by: Kees Cook keesc...@chromium.org Cc:

Re: [PATCH 12/14] HID: sensor-hub: validate feature report details

2013-08-28 Thread Srinivas Pandruvada
On 08/28/2013 01:31 PM, Jiri Kosina wrote: From: Kees Cook keesc...@chromium.org A HID device could send a malicious feature report that would cause the sensor-hub HID driver to read past the end of heap allocation, leaking kernel memory contents to the caller. CVE-2013-2898 Signed-off-by:

Re: [PATCH 12/14] HID: sensor-hub: validate feature report details

2013-08-28 Thread Kees Cook
On Wed, Aug 28, 2013 at 1:42 PM, Jiri Kosina jkos...@suse.cz wrote: On Wed, 28 Aug 2013, Srinivas Pandruvada wrote: A HID device could send a malicious feature report that would cause the sensor-hub HID driver to read past the end of heap allocation, leaking kernel memory contents to the