lkml.org 
[lkml]   [2018]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 18/54] USB: yurex: fix out-of-bounds uaccess in read handler
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jann Horn <jannh@google.com>

    commit f1e255d60ae66a9f672ff9a207ee6cd8e33d2679 upstream.

    In general, accessing userspace memory beyond the length of the supplied
    buffer in VFS read/write handlers can lead to both kernel memory corruption
    (via kernel_read()/kernel_write(), which can e.g. be triggered via
    sys_splice()) and privilege escalation inside userspace.

    Fix it by using simple_read_from_buffer() instead of custom logic.

    Fixes: 6bc235a2e24a ("USB: add driver for Meywa-Denki & Kayac YUREX")
    Signed-off-by: Jann Horn <jannh@google.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/misc/yurex.c | 23 ++++++-----------------
    1 file changed, 6 insertions(+), 17 deletions(-)

    --- a/drivers/usb/misc/yurex.c
    +++ b/drivers/usb/misc/yurex.c
    @@ -400,8 +400,7 @@ static ssize_t yurex_read(struct file *f
    loff_t *ppos)
    {
    struct usb_yurex *dev;
    - int retval = 0;
    - int bytes_read = 0;
    + int len = 0;
    char in_buffer[20];
    unsigned long flags;

    @@ -409,26 +408,16 @@ static ssize_t yurex_read(struct file *f

    mutex_lock(&dev->io_mutex);
    if (!dev->interface) { /* already disconnected */
    - retval = -ENODEV;
    - goto exit;
    + mutex_unlock(&dev->io_mutex);
    + return -ENODEV;
    }

    spin_lock_irqsave(&dev->lock, flags);
    - bytes_read = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
    + len = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
    spin_unlock_irqrestore(&dev->lock, flags);
    -
    - if (*ppos < bytes_read) {
    - if (copy_to_user(buffer, in_buffer + *ppos, bytes_read - *ppos))
    - retval = -EFAULT;
    - else {
    - retval = bytes_read - *ppos;
    - *ppos += bytes_read;
    - }
    - }
    -
    -exit:
    mutex_unlock(&dev->io_mutex);
    - return retval;
    +
    + return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
    }

    static ssize_t yurex_write(struct file *file, const char __user *user_buffer,

    \
     
     \ /
      Last update: 2018-07-16 09:54    [W:3.622 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site