linux-kernel - Re: [PATCH] HID: tighten ioctl command parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <e0557372-b029-4831-8d32-c1eb512ac736@app.fastmail.com>
Date: Fri, 22 Aug 2025 23:08:25 +0200
From: "Arnd Bergmann" <arnd@...db.de>
To: "Benjamin Tissoires" <bentiss@...nel.org>,
 "Arnd Bergmann" <arnd@...nel.org>
Cc: "Jiri Kosina" <jikos@...nel.org>,
 "Peter Hutterer" <peter.hutterer@...-t.net>, linux-input@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] HID: tighten ioctl command parsing

On Thu, Aug 21, 2025, at 08:56, Benjamin Tissoires wrote:
> On Jul 11 2025, Arnd Bergmann wrote:
>>
>> +			break;
>> +	}
>>  
>> +	hid = dev->hid;
>> +	switch (cmd & ~IOCSIZE_MASK) {
>
> Jiri pinged me about this one, and I gave it a go with the existing
> tests I have in selftests... and turns out that this changes the logic
> of the ioctl processing.
>
> The removed block was in the default section of the switch/case
> statement. Now it's added *after*, meaning that any ioctl that was
> normally processed before are now caught in the default of the switch
> statement below and return -ENOTTY.
>
> Running tools/testing/selftests/hid/hid_bpf showed that.

Ah, of course, thanks for checking and describing the issue.

Did you already come up with a fixed patch? I'm currently
travelling and won't be able to send a v2 quickly, so if you
have a version that works for you, let's use that instead.

     Arnd