HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts
authorPavel Skripkin <paskripkin@gmail.com>
Sun, 20 Feb 2022 16:01:14 +0000 (19:01 +0300)
committerJiri Kosina <jkosina@suse.cz>
Mon, 21 Feb 2022 08:15:10 +0000 (09:15 +0100)
commitfc3ef2e3297b3c0e2006b5d7b3d66965e3392036
tree54b57bd2351f8a7f6b4e0f8c5b9834b009708e71
parentac89895213d8950dba6ab342863a0959f73142a7
HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts

Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug.
The root case is in missing validation check of actual number of endpoints.

Code should not blindly access usb_host_interface::endpoint array, since
it may contain less endpoints than code expects.

Fix it by adding missing validaion check and print an error if
number of endpoints do not match expected number

Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels")
Reported-and-tested-by: syzbot+35eebd505e97d315d01c@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/hid-thrustmaster.c