HID: roccat: add bounds checking in kone_sysfs_write_settings()
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 24 Aug 2020 08:57:35 +0000 (11:57 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 29 Oct 2020 08:07:05 +0000 (09:07 +0100)
commit8ef9b6440f890fc60f0616aab90fd7c465ce81bd
treeee348433bc46f2b8b2f2f6647019bec4e720c77e
parentb1d39ad83acf90f48dc2265951542c670a115f9d
HID: roccat: add bounds checking in kone_sysfs_write_settings()

[ Upstream commit d4f98dbfe717490e771b6e701904bfcf4b4557f0 ]

This code doesn't check if "settings->startup_profile" is within bounds
and that could result in an out of bounds array access.  What the code
does do is it checks if the settings can be written to the firmware, so
it's possible that the firmware has a bounds check?  It's safer and
easier to verify when the bounds checking is done in the kernel.

Fixes: 14bf62cde794 ("HID: add driver for Roccat Kone gaming mouse")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/hid/hid-roccat-kone.c