Jann Horn 0fdef3142f USB: yurex: fix out-of-bounds uaccess in read handler ...

commit f1e255d60a upstream.

In general, accessing userspace memory beyond the length of the supplied
buffer in VFS read/write handlers can lead to both kernel memory corruption
(via kernel_read()/kernel_write(), which can e.g. be triggered via
sys_splice()) and privilege escalation inside userspace.

Fix it by using simple_read_from_buffer() instead of custom logic.

Fixes: 6bc235a2e2 ("USB: add driver for Meywa-Denki & Kayac YUREX")
Signed-off-by: Jann Horn <jannh@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-07-17 11:37:52 +02:00

..

sisusbvga

usb: misc: sisusbvga: sisusb: don't print error when allocating urb fails

2016-08-15 15:54:27 +02:00

adutux.c

usb: misc: adutux: don't print on ENOMEM

2016-08-30 19:17:37 +02:00

appledisplay.c

usb: misc: appledisplay: don't print on ENOMEM

2016-08-30 19:17:37 +02:00

chaoskey.c

USB: chaoskey: fix Alea quirk on big-endian hosts

2017-05-25 15:44:38 +02:00

cypress_cy7c63.c

usb: misc: cypress_cy7c63: don't print on ENOMEM

2016-08-30 19:17:37 +02:00

cytherm.c

usb: misc: cytherm: don't print on ENOMEM

2016-08-30 19:17:38 +02:00

ehset.c

usb: ehci: Add support for SINGLE_STEP_SET_FEATURE test of EHSET

2013-08-12 13:13:32 -07:00

emi26.c

usb: delete non-required instances of include <linux/init.h>

2014-01-08 15:01:39 -08:00

emi62.c

usb: delete non-required instances of include <linux/init.h>

2014-01-08 15:01:39 -08:00

ezusb.c

ezusb: constify local structures

2016-09-13 17:24:24 +02:00

ftdi-elan.c

usb: misc: ftdi-elan: don't print on ENOMEM

2016-08-30 19:17:38 +02:00

idmouse.c

USB: idmouse: fix NULL-deref at probe

2017-03-30 09:41:24 +02:00

iowarrior.c

USB: iowarrior: fix info ioctl on big-endian hosts

2017-05-25 15:44:40 +02:00

isight_firmware.c

Merge branch 'usb-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2012-01-09 12:09:47 -08:00

Kconfig

usb: misc: Add driver for usb4604

2016-08-09 15:49:01 +02:00

ldusb.c

usb: ldusb: add PIDs for new CASSY devices supported by this driver

2018-02-28 10:18:32 +01:00

legousbtower.c

usb: misc: legousbtower: Fix memory leak

2017-05-25 15:44:29 +02:00

lvstest.c

usb: misc: lvs: fix race condition in disconnect handling

2018-03-22 09:17:40 +01:00

Makefile

usb: misc: Add driver for usb4604

2016-08-09 15:49:01 +02:00

rio500_usb.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

rio500.c

usb: delete non-required instances of include <linux/init.h>

2014-01-08 15:01:39 -08:00

trancevibrator.c

usb: misc: trancevibrator: don't print on ENOMEM

2016-08-30 19:17:38 +02:00

ucsi.c

usb: Add driver for UCSI

2016-04-29 15:29:18 -07:00

ucsi.h

usb: Add driver for UCSI

2016-04-29 15:29:18 -07:00

usb3503.c

usb: misc: usb3503: make sure reset is low for at least 100us

2018-01-17 09:38:55 +01:00

usb4604.c

usb: misc: Add driver for usb4604

2016-08-09 15:49:01 +02:00

usb_u132.h

Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6

2006-12-01 16:41:58 -08:00

usblcd.c

usb: misc: usblcd: don't print on ENOMEM

2016-08-30 19:17:38 +02:00

usbsevseg.c

usb: misc: usbsevseg: don't print on ENOMEM

2016-08-30 19:17:38 +02:00

usbtest.c

usb: usbtest: fix NULL pointer dereference

2017-11-18 11:22:24 +01:00

uss720.c

USB: uss720: fix NULL-deref at probe

2017-03-30 09:41:24 +02:00

yurex.c

USB: yurex: fix out-of-bounds uaccess in read handler

2018-07-17 11:37:52 +02:00