usb: usbtest: avoid integer overflow in test_ctrl_queue() (e65cdfae) · Commits · 戴 / test

Avoid overflowing context.count = param->sglen * param->iterations, where both `sglen' and `iterations' are from userspace. | test_ctrl_queue() | usbtest_ioctl() Keep -EOPNOTSUPP for error code. Signed-off-by:

Xi Wang <xi.wang@gmail.com> Acked-by:

Alan Stern <stern@rowland.harvard.edu> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/usb/misc/usbtest.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -904,6 +904,9 @@ test_ctrl_queue(struct usbtest_dev dev, struct usbtest_param param)
		struct ctrl_ctx context;
		int i;

		if (param->sglen == 0 \|\| param->iterations > UINT_MAX / param->sglen)
		return -EOPNOTSUPP;

		spin_lock_init(&context.lock);
		context.dev = dev;
		init_completion(&context.complete);
		@@ -1981,8 +1984,6 @@ usbtest_ioctl(struct usb_interface intf, unsigned int code, void buf)

		/* queued control messaging */
		case 10:
		if (param->sglen == 0)
		break;
		retval = 0;
		dev_info(&intf->dev,
		"TEST 10: queue %d control calls, %d times\n",

Admin message