]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
usb: misc: usbtest: Fix overflow in usbtest_do_ioctl()
authorDan Carpenter <dan.carpenter@oracle.com>
Sat, 30 Sep 2017 08:15:29 +0000 (11:15 +0300)
committerFelipe Balbi <felipe.balbi@linux.intel.com>
Wed, 11 Oct 2017 10:14:09 +0000 (13:14 +0300)
commitcb84f56861eb333af0a5bab475d741b13067c05c
treed74aad2ca497cf19faeca8e6f9a6e3071ac46c3b
parent29c7f3e68eec4ae94d85ad7b5dfdafdb8089f513
usb: misc: usbtest: Fix overflow in usbtest_do_ioctl()

There used to be a test against "if (param->sglen > MAX_SGLEN)" but it
was removed during a refactor.  It leads to an integer overflow and a
stack overflow in test_queue() if we try to create a too large urbs[]
array on the stack.

There is a second integer overflow in test_queue() as well if
"param->iterations" is too high.  I don't immediately see that it's
harmful but I've added a check to prevent it and silence the static
checker warning.

Fixes: 18fc4ebdc705 ("usb: misc: usbtest: Remove timeval usage")
Acked-by: Deepa Dinamani <deepa.kernel@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
drivers/usb/misc/usbtest.c