[PATCH rtw-next v2] wifi: rtw89: debug: return the error when a read handler fails

[PATCH rtw-next v2] wifi: rtw89: debug: return the error when a read handler fails

[Devin Wittmayer]

Return the error when a read handler fails, instead of passing it to the
copy to userspace as a length:

  rtw89_8852bu 2-1:1.0: invalid read reg len 0
  usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-8k' (offset 56, size 262144)!
  kernel BUG at mm/usercopy.c:102!

Fixes: 831cceed3baf ("wifi: rtw89: debugfs: implement file_ops::read/write to replace seq_file")
Cc: stable@vger.kernel.org
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
---
v2: reword commit message

Reading read_reg in debugfs before choosing a register gives the log
above every time on an RTL8852BU. I found it while testing an RTL8922AU
patch, and it does the same there. After the BUG the driver cannot be
unloaded. Without hardened usercopy the read returns kernel memory
instead. The error is also kept for reads at a later offset, so reading
mac_mem_dump at offset 1 after a failed read hits it too.

  RTL8852BU over USB                 before    after
  read_reg, nothing chosen
    6.18.52                          BUG       -EINVAL
    7.2.6                            BUG       -EINVAL
    6.18.52, hardened usercopy off   256 KB    -EINVAL
  mac_mem_dump at offset 1,
  after a failed read
    6.18.52                          BUG       -ENOENT
    7.2.6                            BUG       -ENOENT
    6.18.52, hardened usercopy off   256 KB    -ENOENT

  RTL8922AU over USB                 before    after
  read_reg, nothing chosen
    7.2.6                            BUG       -EINVAL
  mac_mem_dump at offset 1,
  after a failed read
    7.2.6                            BUG       -ENOENT

 drivers/net/wireless/realtek/rtw89/debug.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c
index 3a430bd08..3b7f8a809 100644
--- a/drivers/net/wireless/realtek/rtw89/debug.c
+++ b/drivers/net/wireless/realtek/rtw89/debug.c
@@ -185,6 +185,9 @@ static ssize_t rtw89_debugfs_file_read(struct file *file, char __user *userbuf,
 	debugfs_priv->rused = n;
 
 out:
+	if (n < 0)
+		return n;
+
 	return simple_read_from_buffer(userbuf, count, ppos, buf, n);
 }
 
-- 
2.56.0

RE: [PATCH rtw-next v2] wifi: rtw89: debug: return the error when a read handler fails

[Ping-Ke Shih]

Devin Wittmayer <lucid_duck@justthetip.ca> wrote:
> Return the error when a read handler fails, instead of passing it to the
> copy to userspace as a length:
> 
>   rtw89_8852bu 2-1:1.0: invalid read reg len 0
>   usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-8k' (offset 56, size
> 262144)!
>   kernel BUG at mm/usercopy.c:102!
> 
> Fixes: 831cceed3baf ("wifi: rtw89: debugfs: implement file_ops::read/write to replace seq_file")
> Cc: stable@vger.kernel.org
> Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>

Acked-by: Ping-Ke Shih <pkshih@realtek.com>