[PATCH] HID: mcp2200: reject short read-all responses

[Yousef Alhouseen]

mcp2200_raw_event() casts every READ_ALL response to the full 16-byte
response structure and reads fields through byte 10 without checking the
received report size. A malformed USB device can therefore trigger
out-of-bounds reads from the input buffer.

Complete the pending command with -EMSGSIZE when the response is short.

Fixes: 740329d7120f ("HID: mcp2200: added driver for GPIOs of MCP2200")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>
---
 drivers/hid/hid-mcp2200.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hid/hid-mcp2200.c b/drivers/hid/hid-mcp2200.c
index dafdd5b4a079..d49f3aa44448 100644
--- a/drivers/hid/hid-mcp2200.c
+++ b/drivers/hid/hid-mcp2200.c
@@ -302,6 +302,10 @@ static int mcp2200_raw_event(struct hid_device *hdev, struct hid_report *report,
 	switch (data[0]) {
 	case READ_ALL:
 		all_resp = (struct mcp_read_all_resp *) data;
+		if (size < sizeof(*all_resp)) {
+			mcp->status = -EMSGSIZE;
+			break;
+		}
 		mcp->status = 0;
 		mcp->gpio_inval = all_resp->io_port_val_bmap;
 		mcp->baud_h = all_resp->baud_h;
-- 
2.54.0