lkml.org 
[lkml]   [2018]   [Oct]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 096/113] USB: yurex: Check for truncation in yurex_read()
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ben Hutchings <ben.hutchings@codethink.co.uk>

    [ Upstream commit 14427b86837a4baf1c121934c6599bdb67dfa9fc ]

    snprintf() always returns the full length of the string it could have
    printed, even if it was truncated because the buffer was too small.
    So in case the counter value is truncated, we will over-read from
    in_buffer and over-write to the caller's buffer.

    I don't think it's actually possible for this to happen, but in case
    truncation occurs, WARN and return -EIO.

    Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/misc/yurex.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/usb/misc/yurex.c
    +++ b/drivers/usb/misc/yurex.c
    @@ -431,6 +431,9 @@ static ssize_t yurex_read(struct file *f
    spin_unlock_irqrestore(&dev->lock, flags);
    mutex_unlock(&dev->io_mutex);

    + if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
    + return -EIO;
    +
    return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
    }


    \
     
     \ /
      Last update: 2018-10-08 21:16    [W:4.678 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site