kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/misc
History
Jann Horn 189254a6aa USB: yurex: fix out-of-bounds uaccess in read handler 
commit f1e255d60a upstream.

In general, accessing userspace memory beyond the length of the supplied
buffer in VFS read/write handlers can lead to both kernel memory corruption
(via kernel_read()/kernel_write(), which can e.g. be triggered via
sys_splice()) and privilege escalation inside userspace.

Fix it by using simple_read_from_buffer() instead of custom logic.

Fixes: 6bc235a2e2 ("USB: add driver for Meywa-Denki & Kayac YUREX")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-09-25 23:47:30 +01:00
..
sisusbvga USB: sisusb: add device id for Magic Control USB video 2014-10-05 13:40:57 -07:00
adutux.c usb: misc: adutux: remove redundant error check on copy_to_user return code 2017-06-05 21:17:02 +01:00
appledisplay.c USB: appledisplay: fix race between reading and writing from the device 2014-05-27 16:03:57 -07:00
cypress_cy7c63.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
cytherm.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
ehset.c usb: ehci: Add support for SINGLE_STEP_SET_FEATURE test of EHSET 2013-08-12 13:13:32 -07:00
emi26.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
emi62.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
ezusb.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
ftdi-elan.c usb: ftdi-elan: Use pr_<level> 2014-04-24 13:13:59 -07:00
idmouse.c USB: idmouse: fix NULL-deref at probe 2017-07-18 18:40:13 +01:00
iowarrior.c USB: iowarrior: fix info ioctl on big-endian hosts 2017-09-15 18:29:41 +01:00
isight_firmware.c Merge branch 'usb-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 2012-01-09 12:09:47 -08:00
Kconfig USB: ELAN: Remove useless "default M" lines 2014-02-11 13:47:13 -08:00
ldusb.c usb: ldusb: add PIDs for new CASSY devices supported by this driver 2018-06-16 22:22:16 +01:00
legousbtower.c usb: misc: legousbtower: Fix memory leak 2017-08-26 02:14:50 +01:00
Makefile usb: misc: EHSET Test Fixture device driver for host compliance 2013-07-25 11:49:30 -07:00
rio500.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
rio500_usb.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
trancevibrator.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
usb3503.c usb: misc: usb3503: make sure reset is low for at least 100us 2018-03-03 15:52:22 +00:00
usb_u132.h Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6 2006-12-01 16:41:58 -08:00
usblcd.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
usbled.c usb/misc/usbled: Add Riso Kagaku Webmail Notifier 2014-02-11 14:00:16 -08:00
usbsevseg.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
usbtest.c usb: usbtest: fix NULL pointer dereference 2017-11-11 13:33:40 +00:00
uss720.c USB: uss720: fix NULL-deref at probe 2017-07-18 18:40:13 +01:00
yurex.c USB: yurex: fix out-of-bounds uaccess in read handler 2018-09-25 23:47:30 +01:00