Unconditionally allocate a buffer big enough to hold a struct
authoranton <anton@openbsd.org>
Thu, 4 Feb 2021 06:57:19 +0000 (06:57 +0000)
committeranton <anton@openbsd.org>
Thu, 4 Feb 2021 06:57:19 +0000 (06:57 +0000)
commit3f1fd915736d3228ca41fb84f25f6da6510e4683
treeab2e33d5b0a81a7ad54d9b415beb0e8edf2989c7
parentf8016bd2047d59c69a61db09f408811f9bb88920
Unconditionally allocate a buffer big enough to hold a struct
usb_ctl_report.

Limiting the size of the buffer to the size of the requested report can
cause the ioctl(USB_GET_REPORT) command to fail with EFAULT as the
kernel will always copy sizeof(struct usb_ctl_report) bytes from the
address passed from user space. That is when the given address +
sizeof(struct usb_ctl_report) crosses a page boundary and the adjacent
page is not mapped.

ok mglocker@
usr.bin/usbhidctl/usbhid.c