lkml.org 
[lkml]   [2017]   [Oct]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 13/47] USB: devio: Dont corrupt user memory
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit fa1ed74eb1c233be6131ec92df21ab46499a15b6 upstream.

    The user buffer has "uurb->buffer_length" bytes. If the kernel has more
    information than that, we should truncate it instead of writing past
    the end of the user's buffer. I added a WARN_ONCE() to help the user
    debug the issue.

    Reported-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/core/devio.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    --- a/drivers/usb/core/devio.c
    +++ b/drivers/usb/core/devio.c
    @@ -1417,7 +1417,11 @@ static int proc_do_submiturb(struct usb_
    totlen += isopkt[u].length;
    }
    u *= sizeof(struct usb_iso_packet_descriptor);
    - uurb->buffer_length = totlen;
    + if (totlen <= uurb->buffer_length)
    + uurb->buffer_length = totlen;
    + else
    + WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d",
    + totlen, uurb->buffer_length);
    break;

    default:

    \
     
     \ /
      Last update: 2017-10-10 23:15    [W:4.090 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site