Return the error when a read handler fails, instead of passing it to the copy to userspace as a length: rtw89_8852bu 2-1:1.0: invalid read reg len 0 usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-8k' (offset 56, size 262144)! kernel BUG at mm/usercopy.c:102! Fixes: 831cceed3baf ("wifi: rtw89: debugfs: implement file_ops::read/write to replace seq_file") Cc: stable@vger.kernel.org Signed-off-by: Devin Wittmayer --- v2: reword commit message Reading read_reg in debugfs before choosing a register gives the log above every time on an RTL8852BU. I found it while testing an RTL8922AU patch, and it does the same there. After the BUG the driver cannot be unloaded. Without hardened usercopy the read returns kernel memory instead. The error is also kept for reads at a later offset, so reading mac_mem_dump at offset 1 after a failed read hits it too. RTL8852BU over USB before after read_reg, nothing chosen 6.18.52 BUG -EINVAL 7.2.6 BUG -EINVAL 6.18.52, hardened usercopy off 256 KB -EINVAL mac_mem_dump at offset 1, after a failed read 6.18.52 BUG -ENOENT 7.2.6 BUG -ENOENT 6.18.52, hardened usercopy off 256 KB -ENOENT RTL8922AU over USB before after read_reg, nothing chosen 7.2.6 BUG -EINVAL mac_mem_dump at offset 1, after a failed read 7.2.6 BUG -ENOENT drivers/net/wireless/realtek/rtw89/debug.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c index 3a430bd08..3b7f8a809 100644 --- a/drivers/net/wireless/realtek/rtw89/debug.c +++ b/drivers/net/wireless/realtek/rtw89/debug.c @@ -185,6 +185,9 @@ static ssize_t rtw89_debugfs_file_read(struct file *file, char __user *userbuf, debugfs_priv->rused = n; out: + if (n < 0) + return n; + return simple_read_from_buffer(userbuf, count, ppos, buf, n); } -- 2.56.0