Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1311684 > unrolled thread

[PATCH] usb: fix potential integer overflow in usb_sg_init

Back to article view | Back to linux.kernel

Contents

  [PATCH] usb: fix potential integer overflow in usb_sg_init Insu Yun <wuninsu@gmail.com> - 2016-01-18 18:10 +0100
    Re: [PATCH] usb: fix potential integer overflow in usb_sg_init Alan Stern <stern@rowland.harvard.edu> - 2016-01-18 19:40 +0100

#1311684 — [PATCH] usb: fix potential integer overflow in usb_sg_init

If nents value is sufficient large, e.g 0x40000000, 
then it can overflow size in kmalloc and heap overflow happesns.
Therefore nents value needs to be checked to prevent overflow.

Signed-off-by: Insu Yun <wuninsu@gmail.com>
---
 drivers/usb/core/message.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 8e641b5..53393d5 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -367,7 +367,8 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
 	if (!io || !dev || !sg
 			|| usb_pipecontrol(pipe)
 			|| usb_pipeisoc(pipe)
-			|| nents <= 0)
+			|| nents <= 0
+			|| nents >= UINT_MAX / sizeof(*io->urbs))
 		return -EINVAL;
 
 	spin_lock_init(&io->lock);
-- 
1.9.1

[toc] | [next] | [standalone]

#1311739

On Mon, 18 Jan 2016, Insu Yun wrote:

> If nents value is sufficient large, e.g 0x40000000, 
> then it can overflow size in kmalloc and heap overflow happesns.
> Therefore nents value needs to be checked to prevent overflow.

I don't see why.  You seem to be assuming that failure with -EINVAL is 
better than failure with a heap overflow.  I disagree; a heap overflow 
provides more debugging information to help locate the reason for the 
underlying problem.

Alan Stern

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web