Re: [PATCH RESEND] usb: storage: sierra_ms: reject short SWoC info transfers

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Sep 10, 2026 at 05:31:28PM +0500, syedlabeeq wrote:
> From: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com>
> 
> sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes
> from the device via usb_control_msg(), but its callers only treat a
> negative return value as failure. A device that answers the
> vendor-specific GetSwocInfo request with a short IN transfer is
> therefore accepted, leaving the tail of the freshly allocated
> (kmalloc(), non-zeroing) swoc_info buffer uninitialized.
> 
> truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU
> and swocInfo->LinuxVer from that buffer into the world-readable
> (0444) "truinst" sysfs attribute. An emulated/malicious USB device
> (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes
> of stale kernel heap memory (kmalloc-64) to unprivileged userspace,
> once per sysfs read, indefinitely. On kernels built without
> init_on_alloc this leaks recently freed heap contents.
> 
> Only accept the transfer when the full structure was received.
> sierra_ms_init() already retries failed queries, so well-behaved
> devices are unaffected.
> 
> Fixes: 32fe5e393455 ("USB Storage Sierra: TRU-Install feature update")
> Cc: stable@vger.kernel.org
> Signed-off-by: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com>
> ---
> Resend: the first posting was whitespace-mangled by a webmail client;
> no code changes.
>  drivers/usb/storage/sierra_ms.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/usb/storage/sierra_ms.c b/drivers/usb/storage/sierra_ms.c
> index 177fa6cd143ab2837640c26f8336781ddd3cf9cb..8755fda42eed2afd3235283e990a35aac14cb829 100644
> --- a/drivers/usb/storage/sierra_ms.c
> +++ b/drivers/usb/storage/sierra_ms.c
> @@ -76,6 +76,12 @@
>  			(void *) swocInfo,		/* void *data        */
>  			sizeof(struct swoc_info),	/* __u16 size 	     */
>  			USB_CTRL_SET_TIMEOUT);		/* int timeout 	     */
> +	/*
> +	 * A short IN transfer leaves the tail of swocInfo uninitialized;
> +	 * only a full transfer is valid.
> +	 */
> +	if (result != sizeof(struct swoc_info))
> +		return -EIO;

Don't you need a blank line before this comment?

And did you forget an Assisted-by: tag?

thanks,

greg k-h