Re: [PATCH] usb: storage: sierra_ms: reject short SWoC info transfers

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Sep 04, 2026 at 07:52:59PM +0500, Syed Labeeq Sajid Bukhari wrote:
> sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes
> from the device via usb_control_msg(), but its callers only treat a
> negative return value as failure. A device that answers the
> vendor-specific GetSwocInfo request with a short IN transfer is
> therefore accepted, leaving the tail of the freshly allocated
> (kmalloc(), non-zeroing) swoc_info buffer uninitialized.
> 
> truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU
> and swocInfo->LinuxVer from that buffer into the world-readable
> (0444) "truinst" sysfs attribute. An emulated/malicious USB device
> (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes
> of stale kernel heap memory (kmalloc-64) to unprivileged userspace,
> once per sysfs read, indefinitely. On kernels built without
> init_on_alloc this leaks recently freed heap contents.
> 
> Only accept the transfer when the full structure was received.
> sierra_ms_init() already retries failed queries, so well-behaved
> devices are unaffected.
> 
> Fixes: 32fe5e393455 ("USB Storage Sierra: TRU-Install feature update")
> Cc: stable@vger.kernel.org
> Signed-off-by: Syed Labeeq <syedlabeeq@gmail.com>

Did you forget an Assisted-by: tag?


> ---
>  drivers/usb/storage/sierra_ms.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/usb/storage/sierra_ms.c b/drivers/usb/storage/sierra_ms.c
> index 177fa6cd143ab2837640c26f8336781ddd3cf9cb..8755fda42eed2afd3235283e990a35aac14cb829
> 100644
> --- a/drivers/usb/storage/sierra_ms.c
> +++ b/drivers/usb/storage/sierra_ms.c
> @@ -76,6 +76,12 @@
>   (void *) swocInfo, /* void *data        */
>   sizeof(struct swoc_info), /* __u16 size     */
>   USB_CTRL_SET_TIMEOUT); /* int timeout     */
> + /*
> + * A short IN transfer leaves the tail of swocInfo uninitialized;
> + * only a full transfer is valid.
> + */
> + if (result != sizeof(struct swoc_info))
> + return -EIO;

This is corrupted and can not be applied :(

Also, are you sure the device will not send "short" data?  We've had
bugs in the past where we have added this type of check and it turned
out that it broke valid devices, so be careful.

Was this tested with a real device?

thanks,

greg k-h