diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-12-06 08:36:29 +0100 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-07-04 11:51:08 +0200 |
| commit | 42dc2639ba895d1307bf63e02e52e684e1e5f64b (patch) | |
| tree | 4042de864916e159d902c7e66f82051d0d51aff3 | |
| parent | 77a56bdc85ae3b9b8551033e6f8f869ea8d80422 (diff) | |
usb: gadgetfs: restrict upper bound on device configuration size
commit 0994b0a257557e18ee8f0b7c5f0f73fe2b54eec1 upstream.
Andrey Konovalov reported that we were not properly checking the upper
limit before of a device configuration size before calling
memdup_user(), which could cause some problems.
So set the upper limit to PAGE_SIZE * 4, which should be good enough for
all devices.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
| -rw-r--r-- | drivers/usb/gadget/inode.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c index 42a30903d..5b45429da 100644 --- a/drivers/usb/gadget/inode.c +++ b/drivers/usb/gadget/inode.c @@ -1854,7 +1854,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) u32 tag; char *kbuf; - if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) + if ((len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) || + (len > PAGE_SIZE * 4)) return -EINVAL; /* we might need to change message format someday */ |