USB: ldusb: fix ring-buffer bugs
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest2 patches 5 repliesIn review
- v12 patches 1 replySuperseded
Patches in v2 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | USB: ldusb: fix read info leaksdrivers/ | +11 | 0 replies | |
| 2/2 | USB: ldusb: fix ring-buffer lockingdrivers/ | +12 | 5 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v2 yet.
Cover letter [PATCH v2 0/2] USB: ldusb: fix ring-buffer bugs
Syzbot has been reporting a slab-out-of-bounds/bad user copy in ldusb for some time now.
This turned out to due to a bug in the read() implementation, which would have read() access the uninitialised ring buffer and leak huge amounts of slab data on URB completion errors (e.g. disconnect).
The first patch plugs the info leaks.
The second patch fixes a couple of issues in the custom ring-buffer implementation, which before the first patch also could have led to info leaks.
In an attempt to avoid copying the ring-buffer entry to a temporary buffer while holding the spinlock, I added an smp_rmb() before copy_to_user() which I think will suffice, but I'd appreciate if you could help me verify that. Hence the RFC on that one.
The first commit could go to Linus meanwhile.
Johan
v2
- fix buffer-entry length check in 1/2
Johan Hovold (2):
USB: ldusb: fix read info leaks
USB: ldusb: fix ring-buffer locking
drivers/usb/misc/ldusb.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-)
Signature · 1 line
2.23.0