Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

usb: usbtest: avoid integer overflow in test_ctrl_queue()

Browse source 
Avoid overflowing context.count = param->sglen * param->iterations,
where both `sglen' and `iterations' are from userspace.

| test_ctrl_queue()
| usbtest_ioctl()

Keep -EOPNOTSUPP for error code.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Xi Wang 2012-04-09 15:48:55 -04:00 committed by Greg Kroah-Hartman
parent 8963c487a8
commit e65cdfae71
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/usb/misc/usbtest.c
View file

@ -904,6 +904,9 @@ test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
struct ctrl_ctx context;
int i;
if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
return -EOPNOTSUPP;
spin_lock_init(&context.lock);
context.dev = dev;
init_completion(&context.complete);
@ -1981,8 +1984,6 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
/* queued control messaging */
case 10:
if (param->sglen == 0)
break;
retval = 0;
dev_info(&intf->dev,
"TEST 10: queue %d control calls, %d times\n",