Re: [PATCH v6] soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read

Andrew Jeffery <[email protected]> Wed, 22 Jul 2026 22:18:36 +0930

Newsgroups	org.ozlabs.lists.linux-aspeed,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-hardening,org.kernel.vger.linux-kernel
Message-ID	<178472451625.1415280.9493751198445442679.b4-ty@b4>

On Fri, 12 Jun 2026 19:07:43 +0000, Karthikeyan KS wrote:
> put_fifo_with_discard() acts as both producer and consumer on the kfifo:
> it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from
> the IRQ handler without synchronizing with snoop_file_read(), which also
> consumes via kfifo_to_user(). On SMP systems this concurrent access can
> leave (in - out) larger than the ring buffer, so __kfifo_to_user()'s clamp
> to (in - out) is ineffective and kfifo_copy_to_user() can attempt a
> copy_to_user() past the kmalloc-2k backing store:
> 
> [...]

Thanks, I've applied this to the BMC tree.

-- 
Andrew Jeffery <[email protected]>