From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from codeconstruct.com.au (pi.codeconstruct.com.au [203.29.241.158]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78695346A01 for ; Mon, 18 May 2026 11:14:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.29.241.158 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779102896; cv=none; b=uDcAL9r5I0GJydP3iE/MzF7rJ5nKR+eNwwK0FPwfZMlrp710NVGIOSoV/TaEhCxhMTKI2eN7lCPIGxpa4X7thkGNXouFY0KW02C4/RwS3YhACXrNcZa5XK5rLwduiuxK667QXSLBpdn3+pwx60jv1HzpvFOHrM2b35/lPNXHog0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779102896; c=relaxed/simple; bh=MyiVJtseOt/wJ/BPs1HhhYGYsoYkFKIrRec1rLZAZI0=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=buDzUAARQmGfcUxcGSeSa7KdcwCf3kw9NeRoZAa7eq+CtA7Zc7JOWeKizAjfNiSUbCHtLFZkJ7H7Vu9qQ7oRTv2YZ1inglVr1p+oUxeJ0Yw3c0BI84PqX+v2LbdgitTLpHRDKVH0oRCnbRxqlO0an+y+Sc2v5mbw/Ak6y0EP6kE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=codeconstruct.com.au; spf=pass smtp.mailfrom=codeconstruct.com.au; dkim=pass (2048-bit key) header.d=codeconstruct.com.au header.i=@codeconstruct.com.au header.b=cCj2rXI2; arc=none smtp.client-ip=203.29.241.158 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=codeconstruct.com.au Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=codeconstruct.com.au Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=codeconstruct.com.au header.i=@codeconstruct.com.au header.b="cCj2rXI2" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=codeconstruct.com.au; s=2022a; t=1779102884; bh=MyiVJtseOt/wJ/BPs1HhhYGYsoYkFKIrRec1rLZAZI0=; h=Subject:From:To:Cc:Date:In-Reply-To:References; b=cCj2rXI2vwTYNZ9dlszUmED2XdNsrvPJaEFtwGIc7M/JYYmjcPOlD9XkxlpjQTZmp xE0onjChqeqq1mai/sMxpTKjnBTNxmmA6k7PXucLU3KsJ6tjzs3azRQYlrsWG3v6hR vYrI9C57hueDpLr9/Nm0cumFPWn57AtUaOfYFu/n3QmMr88N1DWvWCb+jvjtg58fs/ /P93TneJIua8FIFIPyJqLZVZRTVryVZ7BUJ52BzU1+Fr69/0/q0pP6u1PQ3Kjw5n4u sKDOLjXkfgEznH1SdkPlDdCUUMqe7jVFFnDYcI4GJQmWEix/rAtgtlqk4kn6g9oEZF pjcklhGOMSYWw== Received: from [192.168.68.117] (unknown [180.150.112.11]) by mail.codeconstruct.com.au (Postfix) with ESMTPSA id CE7B06054D; Mon, 18 May 2026 19:14:43 +0800 (AWST) Message-ID: Subject: Re: [PATCH] soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read From: Andrew Jeffery To: karthikeyan K S , joel@jms.id.au Cc: jdelvare@suse.de, linux-aspeed@lists.ozlabs.org, linux-kernel@vger.kernel.org Date: Mon, 18 May 2026 20:44:43 +0930 In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.56.2-0+deb13u1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Fri, 2026-04-24 at 00:30 +0530, karthikeyan K S wrote: > From c50ff07baf2032ca12133775c61c50a38e8a2029 Mon Sep 17 00:00:00 2001 > From: Karthikeyan KS > Date: Thu, 23 Apr 2026 21:26:08 +0300 > Subject: [PATCH] soc: aspeed: lpc-snoop: Fix usercopy overflow in > =C2=A0snoop_file_read >=20 > snoop_file_read() passes the userspace count directly to > kfifo_to_user() without clamping. The kfifo backing buffer is > 2048 bytes (SNOOP_FIFO_SIZE), allocated from kmalloc-2k slab. > A read larger than 2048 bytes triggers a BUG under > CONFIG_HARDENED_USERCOPY: >=20 > =C2=A0 kernel BUG at mm/usercopy.c:99! >=20 > Reproducer: > =C2=A0 hexdump /dev/aspeed-lpc-snoop0 Can you provide more details on how you achieved this result? __kfifo_to_user() clamps the provided value to the content of the fifo and has done in its current form since 2e956fb32056 ("kfifo: replace the old non generic API"). >=20 > Fix by clamping count to SNOOP_FIFO_SIZE before the copy. >=20 > Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc > chardev") > Cc: stable@vger.kernel.org > Signed-off-by: Karthikeyan KS > --- > =C2=A0drivers/soc/aspeed/aspeed-lpc-snoop.c | 1 + > =C2=A01 file changed, 1 insertion(+) >=20 > diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c > b/drivers/soc/aspeed/aspeed-lpc-snoop.c > index b03310c0830d..5b59e826cc68 100644 > --- a/drivers/soc/aspeed/aspeed-lpc-snoop.c > +++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c > @@ -125,6 +125,7 @@ static ssize_t snoop_file_read(struct file *file, cha= r > __user *buffer, > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 if (ret =3D=3D -ERESTARTSYS) > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 return= -EINTR; > =C2=A0=C2=A0=C2=A0 } > +=C2=A0=C2=A0 count =3D min(count, (size_t)SNOOP_FIFO_SIZE); > =C2=A0=C2=A0=C2=A0 ret =3D kfifo_to_user(&chan->fifo, buffer, count, &cop= ied); > =C2=A0=C2=A0=C2=A0 if (ret) > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 return ret;