]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/commit
HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()
authorHans de Goede <hdegoede@redhat.com>
Sun, 4 Apr 2021 08:04:26 +0000 (10:04 +0200)
committerKelsey Skunberg <kelsey.skunberg@canonical.com>
Mon, 24 May 2021 23:46:35 +0000 (17:46 -0600)
commitc87bd003bd02911147dc601c26cab9141ff18fcd
tree598ae3a8610722890766ba0987655452e4a9f7ca
parent1bc0bdb41fb6c03645470e2b8aabade5f13813a2
HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()

BugLink: https://bugs.launchpad.net/bugs/1929455
[ Upstream commit 34348a8661e3cd67dcf6938f08c8bb77522301f7 ]

The HID lenovo probe function only attaches drvdata to one of the
USB interfaces, but lenovo_event() will get called for all USB interfaces
to which hid-lenovo is bound.

This allows a malicious device to fake being a device handled by
hid-lenovo, which generates events for which lenovo_event() has
special handling (and thus dereferences hid_get_drvdata()) on another
interface triggering a NULL pointer exception.

Add a check for hid_get_drvdata() returning NULL, avoiding this
possible NULL pointer exception.

Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support")
Reviewed-by: Marek BehĂșn <kabel@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kelsey Skunberg <kelsey.skunberg@canonical.com>
drivers/hid/hid-lenovo.c