Mark Salyzyn 97b2c38d20 ANDROID: Bluetooth: hidp: buffer overflow in hidp_process_report ...

The buffer length is unsigned at all layers, but gets cast to int and
checked in hidp_process_report and can lead to a buffer overflow.
Switch len parameter to unsigned int to resolve issue.

Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Fixes: 678af93e46ac10318b54f2f0c9abbdfe75c4e078 ("HID: Bluetooth: hidp: make sure input buffers are big enough")
Bug: 65853588
Change-Id: I779ce783ae7c3bce8c5a66c0954ef31347e42cfc
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 34c56d552bffcaefa84975bea0e55fb4481964fd
Signed-off-by: Dennis Cagle <dcagle@codeaurora.org>

2018-06-21 09:13:34 -07:00

..

bnep

Bluetooth: bnep: fix possible might sleep error in bnep_session

2017-08-30 10:21:52 +02:00

cmtp

Bluetooth: cmtp: fix possible might sleep error in cmtp_session

2017-08-30 10:21:52 +02:00

hidp

ANDROID: Bluetooth: hidp: buffer overflow in hidp_process_report

2018-06-21 09:13:34 -07:00

rfcomm

Bluetooth: Fix using the correct source address type

2016-11-22 22:50:46 +01:00

6lowpan.c

Bluetooth: 6lowpan: fix delay work init in add_peer_chan()

2018-03-22 09:17:52 +01:00

a2mp.c

Bluetooth: Move get info completed callback to a2mp.c

2015-07-30 13:37:22 +02:00

a2mp.h

Bluetooth: Add BT_HS config option

2015-07-30 13:31:59 +02:00

af_bluetooth.c

Merge 4.9.89 into android-4.9

2018-03-22 09:54:47 +01:00

amp.c

Bluetooth: Fix breakage in amp_write_rem_assoc_frag()

2015-08-10 20:41:34 +02:00

amp.h

Bluetooth: Add BT_HS config option

2015-07-30 13:31:59 +02:00

ecc.c

Bluetooth: Add ECC library for LE Secure Connections

2014-12-03 16:51:16 +01:00

ecc.h

Bluetooth: Add ECC library for LE Secure Connections

2014-12-03 16:51:16 +01:00

hci_conn.c

Bluetooth: Fix connection if directed advertising and privacy is used

2018-04-20 08:21:07 +02:00

hci_core.c

Bluetooth: Send HCI Set Event Mask Page 2 command only when needed

2018-04-13 19:48:28 +02:00

hci_debugfs.c

Bluetooth: Add debugfs fields for hardware and firmware info

2016-07-18 09:33:28 +03:00

hci_debugfs.h

Bluetooth: Provide option to enable/disable debugfs information

2015-02-15 18:54:13 +02:00

hci_event.c

Bluetooth: Fix connection if directed advertising and privacy is used

2018-04-20 08:21:07 +02:00

hci_request.c

Bluetooth: Fix append max 11 bytes of name to scan rsp data

2016-10-19 18:42:37 +02:00

hci_request.h

Bluetooth: Fix append max 11 bytes of name to scan rsp data

2016-10-19 18:42:37 +02:00

hci_sock.c

Bluetooth: Fix user channel for 32bit userspace on 64bit kernel

2017-05-20 14:28:41 +02:00

hci_sysfs.c

Bluetooth: Remove controller device attributes

2016-07-09 21:37:11 +03:00

Kconfig

Bluetooth: add LED trigger for indicating HCI is powered up

2016-02-23 20:29:35 +01:00

l2cap_core.c

Bluetooth: Fix connection if directed advertising and privacy is used

2018-04-20 08:21:07 +02:00

l2cap_sock.c

Bluetooth: split sk_filter in l2cap_sock_recv_cb

2016-08-24 16:55:04 +02:00

leds.c

Bluetooth: Add combined LED trigger for controller power

2016-09-19 20:19:34 +02:00

leds.h

Bluetooth: Add combined LED trigger for controller power

2016-09-19 20:19:34 +02:00

lib.c

Bluetooth: Add BT_WARN and bt_dev_warn logging macros

2015-09-24 16:25:44 +02:00

Makefile

Bluetooth: add LED trigger for indicating HCI is powered up

2016-02-23 20:29:35 +01:00

mgmt_util.c

Bluetooth: Add support for sending MGMT commands and events to monitor

2016-09-19 20:19:34 +02:00

mgmt_util.h

Bluetooth: Add generic mgmt helper API

2015-03-17 18:03:08 +01:00

mgmt.c

Bluetooth: Fix append max 11 bytes of name to scan rsp data

2016-10-19 18:42:37 +02:00

sco.c

Bluetooth: Fix using the correct source address type

2016-11-22 22:50:46 +01:00

selftest.c

Bluetooth: Export ECDH selftest result in debugfs

2015-04-02 08:47:38 +03:00

selftest.h

Bluetooth: Add support for self testing framework

2014-12-30 08:53:55 +02:00

smp.c

Bluetooth: Fix missing encryption refresh on Security Request

2018-04-08 12:12:50 +02:00

smp.h

Bluetooth: Fix crash in SMP when unpairing

2015-10-22 09:02:03 +02:00