From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 3.18 04/13] USB: yurex: Check for truncation in yurex_read()
Date: Mon, 1 Oct 2018 00:41:46 +0000 [thread overview]
Message-ID: <20181001004139.147341-4-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20181001004139.147341-1-alexander.levin@microsoft.com>
From: Ben Hutchings <ben.hutchings@codethink.co.uk>
[ Upstream commit 14427b86837a4baf1c121934c6599bdb67dfa9fc ]
snprintf() always returns the full length of the string it could have
printed, even if it was truncated because the buffer was too small.
So in case the counter value is truncated, we will over-read from
in_buffer and over-write to the caller's buffer.
I don't think it's actually possible for this to happen, but in case
truncation occurs, WARN and return -EIO.
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
drivers/usb/misc/yurex.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 83eaccfa9ee5..fbcb1cd4c118 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -430,6 +430,9 @@ static ssize_t yurex_read(struct file *file, char *buffer, size_t count, loff_t
spin_unlock_irqrestore(&dev->lock, flags);
mutex_unlock(&dev->io_mutex);
+ if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
+ return -EIO;
+
return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
}
--
2.17.1
next prev parent reply other threads:[~2018-10-01 0:42 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-01 0:41 [PATCH AUTOSEL 3.18 01/13] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 02/13] pinctrl: msm: Really mask level interrupts to prevent latching Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 03/13] RDMA/ucma: check fd type in ucma_migrate_id() Sasha Levin
2018-10-01 0:41 ` Sasha Levin [this message]
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 05/13] fs/cifs: suppress a string overflow warning Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 06/13] dm thin metadata: try to avoid ever aborting transactions Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 07/13] arch/hexagon: fix kernel/dma.c build warning Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 08/13] hexagon: modify ffs() and fls() to return int Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 09/13] r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 10/13] s390/qeth: don't dump past end of unknown HW header Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 11/13] cifs: read overflow in is_valid_oplock_break() Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 12/13] xen/manage: don't complain about an empty value in control/sysrq node Sasha Levin
2018-10-01 0:41 ` [PATCH AUTOSEL 3.18 13/13] xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181001004139.147341-4-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=ben.hutchings@codethink.co.uk \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).