[PATCH v3 7/8] HID: hid-core: sanitize user input in 'new_id_store'
From: Pawel Zalewski (The Capable Hub) <hidden>
Date: 2026-07-27 14:55:43
Also in:
lkml
Subsystem:
hid core layer, the rest · Maintainers:
Jiri Kosina, Benjamin Tissoires, Linus Torvalds
Only accept 'driver_data' values that match an existing 'id_table' entry within the driver. This makes the field mandatory if the 'id_table' is defined in the HID module and disallows overriding pre-defined values within the driver module with arbitrary entries from the command line. Signed-off-by: Pawel Zalewski (The Capable Hub) <redacted> --- drivers/hid/hid-core.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index cf123347a2af..8679d4f0c60f 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c@@ -2654,6 +2654,8 @@ static ssize_t new_id_store(struct device_driver *drv, const char *buf, size_t count) { struct hid_driver *hdrv = to_hid_driver(drv); + const struct hid_device_id *ids = hdrv->id_table; + struct hid_dynid *dynid; __u32 bus, vendor, product; unsigned long driver_data = 0;
@@ -2664,6 +2666,22 @@ static ssize_t new_id_store(struct device_driver *drv, const char *buf, if (ret < 3) return -EINVAL; + /* Only accept driver_data values that match an + * existing id_table entry + */ + if (ids) { + ret = -EINVAL; + while (ids->bus) { + if (driver_data == ids->driver_data) { + ret = 0; + break; + } + ids++; + } + if (ret) /* No match */ + return ret; + } + dynid = kzalloc_obj(*dynid); if (!dynid) return -ENOMEM;
--
2.43.0