| Message ID | 20180702235937.111619-1-drosen@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Tue, Jul 3, 2018 at 1:59 AM, Daniel Rosenberg <drosen@google.com> wrote: > If our length is greater than the size of the buffer, we > overflow the buffer > > Signed-off-by: Daniel Rosenberg <drosen@google.com> > Cc: stable@vger.kernel.org > --- Looks good: Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cheers, Benjamin > drivers/hid/hid-debug.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) > > diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c > index 8469b6964ff64..b48100236df89 100644 > --- a/drivers/hid/hid-debug.c > +++ b/drivers/hid/hid-debug.c > @@ -1154,6 +1154,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, > goto out; > if (list->tail > list->head) { > len = list->tail - list->head; > + if (len > count) > + len = count; > > if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) { > ret = -EFAULT; > @@ -1163,6 +1165,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, > list->head += len; > } else { > len = HID_DEBUG_BUFSIZE - list->head; > + if (len > count) > + len = count; > > if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) { > ret = -EFAULT; > @@ -1170,7 +1174,9 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, > } > list->head = 0; > ret += len; > - goto copy_rest; > + count -= len; > + if (count > 0) > + goto copy_rest; > } > > } > -- > 2.18.0.399.gad0ab374a1-goog > -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Tue, 3 Jul 2018, Benjamin Tissoires wrote: > > If our length is greater than the size of the buffer, we > > overflow the buffer > > > > Signed-off-by: Daniel Rosenberg <drosen@google.com> > > Cc: stable@vger.kernel.org > > --- > > Looks good: > Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Indeed, thanks a lot for fixing this. Now queued, I'll push it for 4.18.
On Mon, Jul 02, 2018 at 04:59:37PM -0700, Daniel Rosenberg wrote: > If our length is greater than the size of the buffer, we > overflow the buffer Hmm... How about this: buf = list->hid_debug_buf; if (list->tail < list->head) { ret = simple_read_from_buffer(buffer, count, &list->head, buf, HID_DEBUG_BUFSIZE); if (ret < 0) break; if (list->head != buf + HID_DEBUG_BUFSIZE) break; list->head = 0; } n = simple_read_from_buffer(buffer + ret, count - ret, &list->head, buf, list->tail); if (n >= 0) ret += n; if (list->head == buf + HID_DEBUG_BUFSIZE) list->head = 0; instead? -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c index 8469b6964ff64..b48100236df89 100644 --- a/drivers/hid/hid-debug.c +++ b/drivers/hid/hid-debug.c @@ -1154,6 +1154,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, goto out; if (list->tail > list->head) { len = list->tail - list->head; + if (len > count) + len = count; if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) { ret = -EFAULT; @@ -1163,6 +1165,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, list->head += len; } else { len = HID_DEBUG_BUFSIZE - list->head; + if (len > count) + len = count; if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) { ret = -EFAULT; @@ -1170,7 +1174,9 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, } list->head = 0; ret += len; - goto copy_rest; + count -= len; + if (count > 0) + goto copy_rest; } }
If our length is greater than the size of the buffer, we overflow the buffer Signed-off-by: Daniel Rosenberg <drosen@google.com> Cc: stable@vger.kernel.org --- drivers/hid/hid-debug.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)