[Bug 274014] hmt.ko kernel panic - Asus Expertbook B5602

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274014

Mark Johnston <markj@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |markj@FreeBSD.org,
                   |                            |wulf@freebsd.org

--- Comment #1 from Mark Johnston <markj@FreeBSD.org> ---
Here we're crashing while parsing a HID report descriptor, it looks like the
descriptor is invalid somehow but the driver isn't doing enough validation:

753                         if (hi.collevel == 1 &&                             
754                             hi.usage >= HID_USAGE2(HUP_BUTTON, left_btn) && 
755                             hi.usage <= HID_USAGE2(HUP_BUTTON,
HMT_BTN_MAX)) {                                                                 
756                                 btn = (hi.usage & 0xFFFF) - left_btn;       
757                                 setbit(sc->buttons, btn);                   
758                                 sc->btn_loc[btn] = hi.loc;                  
759                                 if (btn >= sc->max_button)                  
760                                         sc->max_button = btn + 1;           
761                                 break;                                      
762                         }

In particular, we don't check that "btn" is in the range [0, 7].

I'm not sure if this means that the descriptor is invalid or whether we're
missing some special case?

-- 
You are receiving this mail because:
You are the assignee for the bug.