From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Fredrik Noring <noring@nocrew.org>,
Pete Zaitcev <zaitcev@redhat.com>
Subject: [PATCH 4.4 60/63] usb: usbmon: Read text within supplied buffer size
Date: Fri, 16 Mar 2018 16:23:32 +0100 [thread overview]
Message-ID: <20180316152306.545131645@linuxfoundation.org> (raw)
In-Reply-To: <20180316152259.964532775@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pete Zaitcev <zaitcev@kotori.zaitcev.us>
commit a5f596830e27e15f7a0ecd6be55e433d776986d8 upstream.
This change fixes buffer overflows and silent data corruption with the
usbmon device driver text file read operations.
Signed-off-by: Fredrik Noring <noring@nocrew.org>
Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/mon/mon_text.c | 124 +++++++++++++++++++++++++++------------------
1 file changed, 77 insertions(+), 47 deletions(-)
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -82,6 +82,8 @@ struct mon_reader_text {
wait_queue_head_t wait;
int printf_size;
+ size_t printf_offset;
+ size_t printf_togo;
char *printf_buf;
struct mutex printf_lock;
@@ -373,75 +375,103 @@ err_alloc:
return rc;
}
-/*
- * For simplicity, we read one record in one system call and throw out
- * what does not fit. This means that the following does not work:
- * dd if=/dbg/usbmon/0t bs=10
- * Also, we do not allow seeks and do not bother advancing the offset.
- */
+static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp,
+ char __user * const buf, const size_t nbytes)
+{
+ const size_t togo = min(nbytes, rp->printf_togo);
+
+ if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo))
+ return -EFAULT;
+ rp->printf_togo -= togo;
+ rp->printf_offset += togo;
+ return togo;
+}
+
+/* ppos is not advanced since the llseek operation is not permitted. */
static ssize_t mon_text_read_t(struct file *file, char __user *buf,
- size_t nbytes, loff_t *ppos)
+ size_t nbytes, loff_t *ppos)
{
struct mon_reader_text *rp = file->private_data;
struct mon_event_text *ep;
struct mon_text_ptr ptr;
+ ssize_t ret;
- ep = mon_text_read_wait(rp, file);
- if (IS_ERR(ep))
- return PTR_ERR(ep);
mutex_lock(&rp->printf_lock);
- ptr.cnt = 0;
- ptr.pbuf = rp->printf_buf;
- ptr.limit = rp->printf_size;
-
- mon_text_read_head_t(rp, &ptr, ep);
- mon_text_read_statset(rp, &ptr, ep);
- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
- " %d", ep->length);
- mon_text_read_data(rp, &ptr, ep);
- if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
- ptr.cnt = -EFAULT;
+ if (rp->printf_togo == 0) {
+
+ ep = mon_text_read_wait(rp, file);
+ if (IS_ERR(ep)) {
+ mutex_unlock(&rp->printf_lock);
+ return PTR_ERR(ep);
+ }
+ ptr.cnt = 0;
+ ptr.pbuf = rp->printf_buf;
+ ptr.limit = rp->printf_size;
+
+ mon_text_read_head_t(rp, &ptr, ep);
+ mon_text_read_statset(rp, &ptr, ep);
+ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+ " %d", ep->length);
+ mon_text_read_data(rp, &ptr, ep);
+
+ rp->printf_togo = ptr.cnt;
+ rp->printf_offset = 0;
+
+ kmem_cache_free(rp->e_slab, ep);
+ }
+
+ ret = mon_text_copy_to_user(rp, buf, nbytes);
mutex_unlock(&rp->printf_lock);
- kmem_cache_free(rp->e_slab, ep);
- return ptr.cnt;
+ return ret;
}
+/* ppos is not advanced since the llseek operation is not permitted. */
static ssize_t mon_text_read_u(struct file *file, char __user *buf,
- size_t nbytes, loff_t *ppos)
+ size_t nbytes, loff_t *ppos)
{
struct mon_reader_text *rp = file->private_data;
struct mon_event_text *ep;
struct mon_text_ptr ptr;
+ ssize_t ret;
- ep = mon_text_read_wait(rp, file);
- if (IS_ERR(ep))
- return PTR_ERR(ep);
mutex_lock(&rp->printf_lock);
- ptr.cnt = 0;
- ptr.pbuf = rp->printf_buf;
- ptr.limit = rp->printf_size;
- mon_text_read_head_u(rp, &ptr, ep);
- if (ep->type == 'E') {
- mon_text_read_statset(rp, &ptr, ep);
- } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
- mon_text_read_isostat(rp, &ptr, ep);
- mon_text_read_isodesc(rp, &ptr, ep);
- } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
- mon_text_read_intstat(rp, &ptr, ep);
- } else {
- mon_text_read_statset(rp, &ptr, ep);
+ if (rp->printf_togo == 0) {
+
+ ep = mon_text_read_wait(rp, file);
+ if (IS_ERR(ep)) {
+ mutex_unlock(&rp->printf_lock);
+ return PTR_ERR(ep);
+ }
+ ptr.cnt = 0;
+ ptr.pbuf = rp->printf_buf;
+ ptr.limit = rp->printf_size;
+
+ mon_text_read_head_u(rp, &ptr, ep);
+ if (ep->type == 'E') {
+ mon_text_read_statset(rp, &ptr, ep);
+ } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
+ mon_text_read_isostat(rp, &ptr, ep);
+ mon_text_read_isodesc(rp, &ptr, ep);
+ } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
+ mon_text_read_intstat(rp, &ptr, ep);
+ } else {
+ mon_text_read_statset(rp, &ptr, ep);
+ }
+ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+ " %d", ep->length);
+ mon_text_read_data(rp, &ptr, ep);
+
+ rp->printf_togo = ptr.cnt;
+ rp->printf_offset = 0;
+
+ kmem_cache_free(rp->e_slab, ep);
}
- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
- " %d", ep->length);
- mon_text_read_data(rp, &ptr, ep);
- if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
- ptr.cnt = -EFAULT;
+ ret = mon_text_copy_to_user(rp, buf, nbytes);
mutex_unlock(&rp->printf_lock);
- kmem_cache_free(rp->e_slab, ep);
- return ptr.cnt;
+ return ret;
}
static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp,
next prev parent reply other threads:[~2018-03-16 15:23 UTC|newest]
Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-16 15:22 [PATCH 4.4 00/63] 4.4.122-stable review Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 01/63] RDMA/ucma: Limit possible option size Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 02/63] RDMA/ucma: Check that user doesnt overflow QP state Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 03/63] RDMA/mlx5: Fix integer overflow while resizing CQ Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 04/63] scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 05/63] workqueue: Allow retrieval of current tasks work struct Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 06/63] drm: Allow determining if current task is output poll worker Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 07/63] drm/nouveau: Fix deadlock on runtime suspend Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 08/63] drm/radeon: " Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 09/63] drm/amdgpu: " Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 10/63] drm/amdgpu: Notify sbios device ready before send request Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 11/63] drm/radeon: fix KV harvesting Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 12/63] drm/amdgpu: " Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 13/63] MIPS: BMIPS: Do not mask IPIs during suspend Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 14/63] MIPS: ath25: Check for kzalloc allocation failure Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 15/63] MIPS: OCTEON: irq: Check for null return on kzalloc allocation Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 16/63] Input: matrix_keypad - fix race when disabling interrupts Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 17/63] loop: Fix lost writes caused by missing flag Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 18/63] kbuild: Handle builtin dtb file names containing hyphens Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 19/63] bcache: dont attach backing with duplicate UUID Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 20/63] x86/MCE: Serialize sysfs changes Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 21/63] ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 22/63] ALSA: seq: Dont allow resizing pool in use Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 23/63] ALSA: seq: More protection for concurrent write and ioctl races Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 24/63] ALSA: hda: add dock and led support for HP EliteBook 820 G3 Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 25/63] ALSA: hda: add dock and led support for HP ProBook 640 G2 Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 26/63] nospec: Include <asm/barrier.h> dependency Greg Kroah-Hartman
2018-03-16 15:22 ` [PATCH 4.4 27/63] watchdog: hpwdt: SMBIOS check Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 28/63] watchdog: hpwdt: Check source of NMI Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 29/63] watchdog: hpwdt: fix unused variable warning Greg Kroah-Hartman
2018-03-16 22:55 ` Jerry Hoemann
2018-03-18 10:14 ` Greg Kroah-Hartman
2018-03-20 23:19 ` Ben Hutchings
2018-03-21 11:11 ` 王金浦
2018-03-21 18:18 ` Guenter Roeck
2018-03-22 11:08 ` 王金浦
2018-04-06 7:51 ` Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 30/63] netfilter: nfnetlink_queue: fix timestamp attribute Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 31/63] ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 32/63] Input: tca8418_keypad - remove double read of key event register Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 33/63] [media] tc358743: fix register i2c_rd/wr function fix Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 34/63] netfilter: add back stackpointer size checks Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 35/63] netfilter: x_tables: fix missing timer initialization in xt_LED Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 36/63] netfilter: nat: cope with negative port range Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 37/63] netfilter: IDLETIMER: be syzkaller friendly Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 38/63] netfilter: ebtables: CONFIG_COMPAT: dont trust userland offsets Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 39/63] netfilter: bridge: ebt_among: add missing match size checks Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 40/63] netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 41/63] netfilter: use skb_to_full_sk in ip_route_me_harder Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 42/63] netfilter: x_tables: pass xt_counters struct instead of packet counter Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 43/63] netfilter: x_tables: pass xt_counters struct to counter allocator Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 44/63] netfilter: x_tables: pack percpu counter allocations Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 45/63] ext4: inplace xattr block update fails to deduplicate blocks Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 46/63] ubi: Fix race condition between ubi volume creation and udev Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 47/63] scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 48/63] NFS: Fix an incorrect type in struct nfs_direct_req Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 49/63] Revert "ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux" Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 50/63] x86/module: Detect and skip invalid relocations Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 51/63] x86: Treat R_X86_64_PLT32 as R_X86_64_PC32 Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 52/63] serial: sh-sci: prevent lockup on full TTY buffers Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 53/63] tty/serial: atmel: add new version check for usart Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 54/63] uas: fix comparison for error code Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 55/63] staging: comedi: fix comedi_nsamples_left Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 56/63] staging: android: ashmem: Fix lockdep issue during llseek Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 57/63] USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 58/63] usb: quirks: add control message delay for 1b1c:1b20 Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 59/63] USB: usbmon: remove assignment from IS_ERR argument Greg Kroah-Hartman
2018-03-16 15:23 ` Greg Kroah-Hartman [this message]
2018-03-16 15:23 ` [PATCH 4.4 61/63] usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb() Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 62/63] serial: 8250_pci: Add Brainboxes UC-260 4 port serial device Greg Kroah-Hartman
2018-03-16 15:23 ` [PATCH 4.4 63/63] fixup: sctp: verify size of a new chunk in _sctp_make_chunk() Greg Kroah-Hartman
2018-03-16 18:05 ` [PATCH 4.4 00/63] 4.4.122-stable review Nathan Chancellor
2018-03-18 10:16 ` Greg Kroah-Hartman
2018-03-28 10:00 ` Greg Kroah-Hartman
2018-03-16 23:20 ` kernelci.org bot
2018-03-17 10:11 ` Naresh Kamboju
2018-03-17 10:21 ` Naresh Kamboju
2018-03-18 10:30 ` Greg Kroah-Hartman
2018-03-17 14:40 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180316152306.545131645@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=noring@nocrew.org \
--cc=stable@vger.kernel.org \
--cc=zaitcev@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).