summaryrefslogtreecommitdiff
path: root/drivers/usb
diff options
context:
space:
mode:
authorBen Hutchings <ben.hutchings@codethink.co.uk>2018-08-15 21:45:37 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-09-05 13:27:06 +0200
commit14427b86837a4baf1c121934c6599bdb67dfa9fc (patch)
tree024d505235dfa259b164e97c4a023d4b6325fb94 /drivers/usb
parent7e10f14ebface44a48275c8d6dc1caae3668d5a9 (diff)
USB: yurex: Check for truncation in yurex_read()
snprintf() always returns the full length of the string it could have printed, even if it was truncated because the buffer was too small. So in case the counter value is truncated, we will over-read from in_buffer and over-write to the caller's buffer. I don't think it's actually possible for this to happen, but in case truncation occurs, WARN and return -EIO. Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/misc/yurex.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 1232dd49556d..6d9fd5f64903 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -413,6 +413,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
spin_unlock_irqrestore(&dev->lock, flags);
mutex_unlock(&dev->io_mutex);
+ if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
+ return -EIO;
+
return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
}