linux-kernel - Re: [PATCH] HID: appleir: Fix potential NULL dereference at raw event handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8oqsp1p4-4nr8-4nq4-2483-9r6n5r05881s@xreary.bet>
Date: Tue, 4 Mar 2025 21:40:16 +0100 (CET)
From: Jiri Kosina <jikos@...nel.org>
To: Daniil Dulov <d.dulov@...ddin.ru>
cc: Benjamin Tissoires <bentiss@...nel.org>, linux-input@...r.kernel.org, 
    linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org, 
    stable@...r.kernel.org
Subject: Re: [PATCH] HID: appleir: Fix potential NULL dereference at raw
 event handle

On Mon, 24 Feb 2025, Daniil Dulov wrote:

> Syzkaller reports a NULL pointer dereference issue in input_event().
> 
> BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
> BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
> BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline]
> BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395
> Read of size 8 at addr 0000000000000028 by task syz-executor199/2949
> 
> CPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Call Trace:
>  <IRQ>
>  __dump_stack lib/dump_stack.c:94 [inline]
>  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
>  kasan_report+0xd9/0x110 mm/kasan/report.c:602
>  check_region_inline mm/kasan/generic.c:183 [inline]
>  kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
>  instrument_atomic_read include/linux/instrumented.h:68 [inline]
>  _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
>  is_event_supported drivers/input/input.c:67 [inline]
>  input_event+0x42/0xa0 drivers/input/input.c:395
>  input_report_key include/linux/input.h:439 [inline]
>  key_down drivers/hid/hid-appleir.c:159 [inline]
>  appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232
>  __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111
>  hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484
>  __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650
>  usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734
>  dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993
>  __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
>  __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803
>  hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820
>  handle_softirqs+0x206/0x8d0 kernel/softirq.c:561
>  __do_softirq kernel/softirq.c:595 [inline]
>  invoke_softirq kernel/softirq.c:435 [inline]
>  __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662
>  irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
>  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
>  sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
>  </IRQ>
>  <TASK>
>  asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
>  __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185
>  add_timer+0x62/0x90 kernel/time/timer.c:1295
>  schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98
>  usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645
>  usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784
>  hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:906 [inline]
>  __se_sys_ioctl fs/ioctl.c:892 [inline]
>  __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>  </TASK>
> 
> This happens due to the malformed report items sent by the emulated device
> which results in a report, that has no fields, being added to the report list.
> Due to this appleir_input_configured() is never called, hidinput_connect()
> fails which results in the HID_CLAIMED_INPUT flag is not being set. However,
> it  does not make appleir_probe() fail and lets the event callback to be
> called without the associated input device.
> 
> Thus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook
> early if the driver didn't claim any input_dev for some reason. Moreover,
> some other hid drivers accessing input_dev in their event callbacks do have
> similar checks, too.
> 
> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
> 
> Fixes: 9a4a5574ce42 ("HID: appleir: add support for Apple ir devices")

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs