soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read

Summary

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from the IRQ handler without synchronizing with snoop_file_read(), which also consumes via kfifo_to_user(). On SMP systems this concurrent access can leave (in - out) larger than the ring buffer, so __kfifo_to_user()'s clamp to (in - out) is ineffective and kfifo_copy_to_user() can attempt a copy_to_user() past the kmalloc-2k backing store: usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-2k' (offset 0, size 2049)! kernel BUG at mm/usercopy.c! Call trace: usercopy_abort __check_heap_object __check_object_size kfifo_copy_to_user __kfifo_to_user snoop_file_read vfs_read Serialize kfifo access with a per-channel spinlock shared between the IRQ handler (producer) and the file reader (consumer). Annotate @fifo with __guarded_by(&lock) and opt the driver into context analysis so the compiler enforces that all fifo access holds the lock.

Timeline

1. Aug 22, 2026, 3:33 PM UTCCVE published
2. Oct 21, 2026, 12:46 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 3772e5da445420543b25825ac2b5971f3743f6e8 · fixed in b87c0d24386ed5106feac12034fe09d893ccb469; From 3772e5da445420543b25825ac2b5971f3743f6e8 · fixed in afe2527eae0b51d5e8ddd77293afab3a5a1311a4; From 3772e5da445420543b25825ac2b5971f3743f6e8 · fixed in 868c478abce858135db3eb65548a577e4b6747ac; From 3772e5da445420543b25825ac2b5971f3743f6e8 · fixed in 131ab677b03349a5ae48da8722ec7075b37ec66e; From 3772e5da445420543b25825ac2b5971f3743f6e8 · fixed in 1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f

• Linux Linux

  4.19

• KernelLinux

  From 4.19.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.1.9

References 5