[PATCH] usb: fix potential integer overflow in usb_sg_init

From	Insu Yun <wuninsu@gmail.com>
Newsgroups	linux.kernel
Subject	[PATCH] usb: fix potential integer overflow in usb_sg_init
Date	2016-01-18 18:10 +0100
Message-ID	<qSltw-3KT-27@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

If nents value is sufficient large, e.g 0x40000000, 
then it can overflow size in kmalloc and heap overflow happesns.
Therefore nents value needs to be checked to prevent overflow.

Signed-off-by: Insu Yun <wuninsu@gmail.com>
---
 drivers/usb/core/message.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 8e641b5..53393d5 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -367,7 +367,8 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
 	if (!io || !dev || !sg
 			|| usb_pipecontrol(pipe)
 			|| usb_pipeisoc(pipe)
-			|| nents <= 0)
+			|| nents <= 0
+			|| nents >= UINT_MAX / sizeof(*io->urbs))
 		return -EINVAL;
 
 	spin_lock_init(&io->lock);
-- 
1.9.1

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] usb: fix potential integer overflow in usb_sg_init Insu Yun <wuninsu@gmail.com> - 2016-01-18 18:10 +0100
  Re: [PATCH] usb: fix potential integer overflow in usb_sg_init Alan Stern <stern@rowland.harvard.edu> - 2016-01-18 19:40 +0100

csiph-web