• Johan Hovold's avatar
    USB: ldusb: fix read info leaks · 9f7e1574
    Johan Hovold authored
    commit 7a6f22d7 upstream.
    
    Fix broken read implementation, which could be used to trigger slab info
    leaks.
    
    The driver failed to check if the custom ring buffer was still empty
    when waking up after having waited for more data. This would happen on
    every interrupt-in completion, even if no data had been added to the
    ring buffer (e.g. on disconnect events).
    
    Due to missing sanity checks and uninitialised (kmalloced) ring-buffer
    entries, this meant that huge slab info leaks could easily be triggered.
    
    Note that the empty-buffer check after wakeup is enough to fix the info
    leak on disconnect, but let's clear the buffer on allocation and add a
    sanity check to read() to prevent further leaks.
    
    Fixes: 2824bd25 ("[PATCH] USB: add ldusb driver")
    Cc: stable <stable@vger.kernel.org>     # 2.6.13
    Reported-by: syzbot+6fe95b826644f7f12b0b@syzkaller.appspotmail.com
    Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
    Link: https://lore.kernel.org/r/20191018151955.25135-2-johan@kernel.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    9f7e1574
ldusb.c 24.4 KB