)]}'
{
  "commit": "b419957a802ee4d0cd7a646a2fd6cb2967dc11ef",
  "tree": "cb400c7d6de8010a6dd5d6943c0f41c0d5f04601",
  "parents": [
    "d0c10daf210aedcc626369a82eb7727d59bc1f1a"
  ],
  "author": {
    "name": "Alexander Larkin",
    "email": "avlarkin82@gmail.com",
    "time": "Sun Jul 04 22:39:36 2021 -0700"
  },
  "committer": {
    "name": "COS Cherry Picker",
    "email": "cloud-image-release@prod.google.com",
    "time": "Fri Jul 16 11:31:54 2021 -0700"
  },
  "message": "Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl\n\nEven though we validate user-provided inputs we then traverse past\nvalidated data when applying the new map. The issue was originally\ndiscovered by Murray McAllister with this simple POC (if the following\nis executed by an unprivileged user it will instantly panic the system):\n\nint main(void) {\n\tint fd, ret;\n\tunsigned int buffer[10000];\n\n\tfd \u003d open(\"/dev/input/js0\", O_RDONLY);\n\tif (fd \u003d\u003d -1)\n\t\tprintf(\"Error opening file\\n\");\n\n\tret \u003d ioctl(fd, JSIOCSBTNMAP \u0026 ~IOCSIZE_MASK, \u0026buffer);\n\tprintf(\"%d\\n\", ret);\n}\n\nThe solution is to traverse internal buffer which is guaranteed to only\ncontain valid date when constructing the map.\n\nBUG\u003db/193628631\nTEST\u003dpresubmit\nSOURCE\u003dUPSTREAM(f8f84af5da9ee04ef1d271528656dac42a090d00)\nRELEASE_NOTE\u003dFix CVE-2021-3612\n\ncos-patch: security-high\nFixes: 182d679b2298 (\"Input: joydev - prevent potential read overflow in ioctl\")\nFixes: 999b874f4aa3 (\"Input: joydev - validate axis/button maps before clobbering current ones\")\nReported-by: Murray McAllister \u003cmurray.mcallister@gmail.com\u003e\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Alexander Larkin \u003cavlarkin82@gmail.com\u003e\nLink: https://lore.kernel.org/r/20210620120030.1513655-1-avlarkin82@gmail.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nChange-Id: Id4d5ab30af346a1574b7ad5ae2b5a6d35887117c\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/19471\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Vaibhav Rustagi \u003cvaibhavrustagi@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "430dc69750048a88105551979b8e1640e9cf07ac",
      "old_mode": 33188,
      "old_path": "drivers/input/joydev.c",
      "new_id": "675fcd0952a2d9923e6d2010d2305d3513a09db2",
      "new_mode": 33188,
      "new_path": "drivers/input/joydev.c"
    }
  ]
}