USB: yurex: fix out-of-bounds uaccess in read handler
authorJann Horn <jannh@google.com>
Fri, 6 Jul 2018 15:12:56 +0000 (17:12 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 17 Jul 2018 09:37:52 +0000 (11:37 +0200)
commit0fdef3142f99430b94f5d394ca2b181d20d87e77
treef4acf07425fc28c6e0f3e1b26ae43812f9655a09
parent7e7c86d2757067f52fa1a81f5d472f5662bd0e7f
USB: yurex: fix out-of-bounds uaccess in read handler

commit f1e255d60ae66a9f672ff9a207ee6cd8e33d2679 upstream.

In general, accessing userspace memory beyond the length of the supplied
buffer in VFS read/write handlers can lead to both kernel memory corruption
(via kernel_read()/kernel_write(), which can e.g. be triggered via
sys_splice()) and privilege escalation inside userspace.

Fix it by using simple_read_from_buffer() instead of custom logic.

Fixes: 6bc235a2e24a ("USB: add driver for Meywa-Denki & Kayac YUREX")
Signed-off-by: Jann Horn <jannh@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/misc/yurex.c