Return-Path: From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Ben Hutchings , Greg Kroah-Hartman , Sasha Levin Subject: [PATCH AUTOSEL 4.9 08/26] USB: yurex: Check for truncation in yurex_read() Date: Mon, 1 Oct 2018 00:40:34 +0000 Message-ID: <20181001004026.147201-8-alexander.levin@microsoft.com> References: <20181001004026.147201-1-alexander.levin@microsoft.com> In-Reply-To: <20181001004026.147201-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: From: Ben Hutchings [ Upstream commit 14427b86837a4baf1c121934c6599bdb67dfa9fc ] snprintf() always returns the full length of the string it could have printed, even if it was truncated because the buffer was too small. So in case the counter value is truncated, we will over-read from in_buffer and over-write to the caller's buffer. I don't think it's actually possible for this to happen, but in case truncation occurs, WARN and return -EIO. Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/misc/yurex.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c index e36c6c6452cd..1e672343bcd6 100644 --- a/drivers/usb/misc/yurex.c +++ b/drivers/usb/misc/yurex.c @@ -423,6 +423,9 @@ static ssize_t yurex_read(struct file *file, char __use= r *buffer, size_t count, spin_unlock_irqrestore(&dev->lock, flags); mutex_unlock(&dev->io_mutex); =20 + if (WARN_ON_ONCE(len >=3D sizeof(in_buffer))) + return -EIO; + return simple_read_from_buffer(buffer, count, ppos, in_buffer, len); } =20 --=20 2.17.1