linux-kernel - [PATCH] drivers/hid: avoid invalid denominator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210411150623.8367-1-hcvcastro@gmail.com>
Date:   Sun, 11 Apr 2021 11:06:23 -0400
From:   Henry Castro <hcvcastro@...il.com>
To:     jikos@...nel.org
Cc:     Henry Castro <hcvcastro@...il.com>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] drivers/hid: avoid invalid denominator

Avoid a potential panic in case wrong denominator
is given.

Signed-off-by: Henry Castro <hcvcastro@...il.com>
---
 drivers/hid/hid-sony.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 8319b0ce385a..67b45d82cc3b 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -1134,11 +1134,16 @@ static void dualshock4_parse_report(struct sony_sc *sc, u8 *rd, int size)
 		 * Note: we swap numerator 'x' and 'numer' in mult_frac for
 		 *       precision reasons so we don't need 64-bit.
 		 */
-		int calib_data = mult_frac(calib->sens_numer,
-					   raw_data - calib->bias,
-					   calib->sens_denom);
+		if (calib->sens_denom != 0) {
+			int calib_data = mult_frac(calib->sens_numer,
+						   raw_data - calib->bias,
+						   calib->sens_denom);
+
+			input_report_abs(sc->sensor_dev, calib->abs_code, calib_data);
+		} else {
+			hid_warn(sc->hdev, "DualShock 4 parse report, avoid invalid denominator");
+		}
 
-		input_report_abs(sc->sensor_dev, calib->abs_code, calib_data);
 		offset += 2;
 	}
 	input_sync(sc->sensor_dev);
-- 
2.20.1