USB: yurex: fix out-of-bounds uaccess in read handler
authorJann Horn <jannh@google.com>
Fri, 6 Jul 2018 15:12:56 +0000 (17:12 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 17 Jul 2018 09:39:26 +0000 (11:39 +0200)
commit90f2a76ccd37cce2530df49335bcea6cd0e23797
treef79c2e257aa853a7b96c0946fafb608447f1b6ab
parentf24b02c3a0818651f179bdf1026a8de67a97070f
USB: yurex: fix out-of-bounds uaccess in read handler

commit f1e255d60ae66a9f672ff9a207ee6cd8e33d2679 upstream.

In general, accessing userspace memory beyond the length of the supplied
buffer in VFS read/write handlers can lead to both kernel memory corruption
(via kernel_read()/kernel_write(), which can e.g. be triggered via
sys_splice()) and privilege escalation inside userspace.

Fix it by using simple_read_from_buffer() instead of custom logic.

Fixes: 6bc235a2e24a ("USB: add driver for Meywa-Denki & Kayac YUREX")
Signed-off-by: Jann Horn <jannh@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/misc/yurex.c