[PATCH RESEND] usb: storage: sierra_ms: reject short SWoC info transfers

[PATCH RESEND] usb: storage: sierra_ms: reject short SWoC info transfers

[syedlabeeq]

From: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com>

sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes
from the device via usb_control_msg(), but its callers only treat a
negative return value as failure. A device that answers the
vendor-specific GetSwocInfo request with a short IN transfer is
therefore accepted, leaving the tail of the freshly allocated
(kmalloc(), non-zeroing) swoc_info buffer uninitialized.

truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU
and swocInfo->LinuxVer from that buffer into the world-readable
(0444) "truinst" sysfs attribute. An emulated/malicious USB device
(VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes
of stale kernel heap memory (kmalloc-64) to unprivileged userspace,
once per sysfs read, indefinitely. On kernels built without
init_on_alloc this leaks recently freed heap contents.

Only accept the transfer when the full structure was received.
sierra_ms_init() already retries failed queries, so well-behaved
devices are unaffected.

Fixes: 32fe5e393455 ("USB Storage Sierra: TRU-Install feature update")
Cc: stable@vger.kernel.org
Signed-off-by: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com>
---
Resend: the first posting was whitespace-mangled by a webmail client;
no code changes.
 drivers/usb/storage/sierra_ms.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/storage/sierra_ms.c b/drivers/usb/storage/sierra_ms.c
index 177fa6cd143ab2837640c26f8336781ddd3cf9cb..8755fda42eed2afd3235283e990a35aac14cb829 100644
--- a/drivers/usb/storage/sierra_ms.c
+++ b/drivers/usb/storage/sierra_ms.c
@@ -76,6 +76,12 @@
 			(void *) swocInfo,		/* void *data        */
 			sizeof(struct swoc_info),	/* __u16 size 	     */
 			USB_CTRL_SET_TIMEOUT);		/* int timeout 	     */
+	/*
+	 * A short IN transfer leaves the tail of swocInfo uninitialized;
+	 * only a full transfer is valid.
+	 */
+	if (result != sizeof(struct swoc_info))
+		return -EIO;
 
 	swocInfo->LinuxSKU = le16_to_cpu(swocInfo->LinuxSKU);
 	swocInfo->LinuxVer = le16_to_cpu(swocInfo->LinuxVer);
-- 
2.43.0

Re: [PATCH RESEND] usb: storage: sierra_ms: reject short SWoC info transfers

[Greg KH]

On Thu, Sep 10, 2026 at 05:31:28PM +0500, syedlabeeq wrote:
> From: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com>
> 
> sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes
> from the device via usb_control_msg(), but its callers only treat a
> negative return value as failure. A device that answers the
> vendor-specific GetSwocInfo request with a short IN transfer is
> therefore accepted, leaving the tail of the freshly allocated
> (kmalloc(), non-zeroing) swoc_info buffer uninitialized.
> 
> truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU
> and swocInfo->LinuxVer from that buffer into the world-readable
> (0444) "truinst" sysfs attribute. An emulated/malicious USB device
> (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes
> of stale kernel heap memory (kmalloc-64) to unprivileged userspace,
> once per sysfs read, indefinitely. On kernels built without
> init_on_alloc this leaks recently freed heap contents.
> 
> Only accept the transfer when the full structure was received.
> sierra_ms_init() already retries failed queries, so well-behaved
> devices are unaffected.
> 
> Fixes: 32fe5e393455 ("USB Storage Sierra: TRU-Install feature update")
> Cc: stable@vger.kernel.org
> Signed-off-by: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com>
> ---
> Resend: the first posting was whitespace-mangled by a webmail client;
> no code changes.
>  drivers/usb/storage/sierra_ms.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/usb/storage/sierra_ms.c b/drivers/usb/storage/sierra_ms.c
> index 177fa6cd143ab2837640c26f8336781ddd3cf9cb..8755fda42eed2afd3235283e990a35aac14cb829 100644
> --- a/drivers/usb/storage/sierra_ms.c
> +++ b/drivers/usb/storage/sierra_ms.c
> @@ -76,6 +76,12 @@
>  			(void *) swocInfo,		/* void *data        */
>  			sizeof(struct swoc_info),	/* __u16 size 	     */
>  			USB_CTRL_SET_TIMEOUT);		/* int timeout 	     */
> +	/*
> +	 * A short IN transfer leaves the tail of swocInfo uninitialized;
> +	 * only a full transfer is valid.
> +	 */
> +	if (result != sizeof(struct swoc_info))
> +		return -EIO;

Don't you need a blank line before this comment?

And did you forget an Assisted-by: tag?

thanks,

greg k-h

Re: [PATCH RESEND] usb: storage: sierra_ms: reject short SWoC info transfers

[Syed Labeeq Sajid Bukhari]

Good catch on both. i hv sent v2 with the blank line and the Assisted-by tag.

Thanks,
Syed Labeeq

On Thu, Sep 10, 2026 at 6:40 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Thu, Sep 10, 2026 at 05:31:28PM +0500, syedlabeeq wrote:
> > From: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com>
> >
> > sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes
> > from the device via usb_control_msg(), but its callers only treat a
> > negative return value as failure. A device that answers the
> > vendor-specific GetSwocInfo request with a short IN transfer is
> > therefore accepted, leaving the tail of the freshly allocated
> > (kmalloc(), non-zeroing) swoc_info buffer uninitialized.
> >
> > truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU
> > and swocInfo->LinuxVer from that buffer into the world-readable
> > (0444) "truinst" sysfs attribute. An emulated/malicious USB device
> > (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes
> > of stale kernel heap memory (kmalloc-64) to unprivileged userspace,
> > once per sysfs read, indefinitely. On kernels built without
> > init_on_alloc this leaks recently freed heap contents.
> >
> > Only accept the transfer when the full structure was received.
> > sierra_ms_init() already retries failed queries, so well-behaved
> > devices are unaffected.
> >
> > Fixes: 32fe5e393455 ("USB Storage Sierra: TRU-Install feature update")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Syed Labeeq Sajid Bukhari <syedlabeeq@gmail.com>
> > ---
> > Resend: the first posting was whitespace-mangled by a webmail client;
> > no code changes.
> >  drivers/usb/storage/sierra_ms.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > diff --git a/drivers/usb/storage/sierra_ms.c b/drivers/usb/storage/sierra_ms.c
> > index 177fa6cd143ab2837640c26f8336781ddd3cf9cb..8755fda42eed2afd3235283e990a35aac14cb829 100644
> > --- a/drivers/usb/storage/sierra_ms.c
> > +++ b/drivers/usb/storage/sierra_ms.c
> > @@ -76,6 +76,12 @@
> >                       (void *) swocInfo,              /* void *data        */
> >                       sizeof(struct swoc_info),       /* __u16 size        */
> >                       USB_CTRL_SET_TIMEOUT);          /* int timeout       */
> > +     /*
> > +      * A short IN transfer leaves the tail of swocInfo uninitialized;
> > +      * only a full transfer is valid.
> > +      */
> > +     if (result != sizeof(struct swoc_info))
> > +             return -EIO;
>
> Don't you need a blank line before this comment?
>
> And did you forget an Assisted-by: tag?
>
> thanks,
>
> greg k-h