From: Johan Hovold <johan@kernel.org>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Alan Stern <stern@rowland.harvard.edu>,
Oliver Neukum <oneukum@suse.com>,
"Paul E . McKenney" <paulmck@linux.vnet.ibm.com>,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
Johan Hovold <johan@kernel.org>
Subject: [PATCH v2 0/2] USB: ldusb: fix ring-buffer bugs
Date: Fri, 18 Oct 2019 17:19:53 +0200 [thread overview]
Message-ID: <20191018151955.25135-1-johan@kernel.org> (raw)
Syzbot has been reporting a slab-out-of-bounds/bad user copy in ldusb
for some time now.
This turned out to due to a bug in the read() implementation, which
would have read() access the uninitialised ring buffer and leak huge
amounts of slab data on URB completion errors (e.g. disconnect).
The first patch plugs the info leaks.
The second patch fixes a couple of issues in the custom ring-buffer
implementation, which before the first patch also could have led to
info leaks.
In an attempt to avoid copying the ring-buffer entry to a temporary
buffer while holding the spinlock, I added an smp_rmb() before
copy_to_user() which I think will suffice, but I'd appreciate if you
could help me verify that. Hence the RFC on that one.
The first commit could go to Linus meanwhile.
Johan
v2
- fix buffer-entry length check in 1/2
Johan Hovold (2):
USB: ldusb: fix read info leaks
USB: ldusb: fix ring-buffer locking
drivers/usb/misc/ldusb.c | 31 ++++++++++++++++++++++---------
1 file changed, 22 insertions(+), 9 deletions(-)
--
2.23.0
next reply other threads:[~2019-10-18 15:20 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-18 15:19 Johan Hovold [this message]
2019-10-18 15:19 ` [PATCH v2 1/2] USB: ldusb: fix read info leaks Johan Hovold
2019-10-18 15:19 ` [PATCH RFC v2 2/2] USB: ldusb: fix ring-buffer locking Johan Hovold
2019-10-18 18:54 ` Greg Kroah-Hartman
2019-10-21 8:56 ` Johan Hovold
2019-10-21 13:48 ` Greg Kroah-Hartman
2019-10-21 15:17 ` Alan Stern
2019-10-21 18:30 ` Johan Hovold
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191018151955.25135-1-johan@kernel.org \
--to=johan@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=oneukum@suse.com \
--cc=paulmck@linux.vnet.ibm.com \
--cc=stern@rowland.harvard.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).