Patch "platform/chrome: cros_ec_dev - double fetch bug in ioctl" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

platform/chrome: cros_ec_dev - double fetch bug in ioctl

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
platform-chrome-cros_ec_dev-double-fetch-bug-in-ioctl.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dan Carpenter <[email protected]>
Date: Tue, 21 Jun 2016 16:58:46 +0300
Subject: platform/chrome: cros_ec_dev - double fetch bug in ioctl

From: Dan Carpenter <[email protected]>

commit 096cdc6f52225835ff503f987a0d68ef770bb78e upstream.

We verify "u_cmd.outsize" and "u_cmd.insize" but we need to make sure that those values have not changed between the two copy_from_user() calls. Otherwise it could lead to a buffer overflow.

Additionally, cros_ec_cmd_xfer() can set s_cmd->insize to a lower value. We should use the new smaller value so we don't copy too much data to the user.

---
 drivers/platform/chrome/cros_ec_dev.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

@@ -147,13 +147,19 @@ static long ec_device_ioctl_xcmd(struct
 		goto exit;
 	}
 
+	if (u_cmd.outsize != s_cmd->outsize ||
+	    u_cmd.insize != s_cmd->insize) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
 	s_cmd->command += ec->cmd_offset;
 	ret = cros_ec_cmd_xfer(ec->ec_dev, s_cmd);
 	/* Only copy data to userland if data was received. */
 	if (ret < 0)
 		goto exit;
 
-	if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + u_cmd.insize))
+	if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize))
 		ret = -EFAULT;
 exit:
 	kfree(s_cmd);

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/platform-chrome-cros_ec_dev-double-fetch-bug-in-ioctl.patch