| From d096dab7588b050dc556117079043f8b4a194f92 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Date: Tue, 6 Dec 2016 08:36:29 +0100 |
| Subject: [PATCH] usb: gadgetfs: restrict upper bound on device configuration |
| size |
| |
| commit 0994b0a257557e18ee8f0b7c5f0f73fe2b54eec1 upstream. |
| |
| Andrey Konovalov reported that we were not properly checking the upper |
| limit before of a device configuration size before calling |
| memdup_user(), which could cause some problems. |
| |
| So set the upper limit to PAGE_SIZE * 4, which should be good enough for |
| all devices. |
| |
| Reported-by: Andrey Konovalov <andreyknvl@google.com> |
| Cc: stable <stable@vger.kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c |
| index 16104b5ebdcb..d93c93957b48 100644 |
| --- a/drivers/usb/gadget/legacy/inode.c |
| +++ b/drivers/usb/gadget/legacy/inode.c |
| @@ -1762,7 +1762,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) |
| } |
| spin_unlock_irq(&dev->lock); |
| |
| - if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) |
| + if ((len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) || |
| + (len > PAGE_SIZE * 4)) |
| return -EINVAL; |
| |
| /* we might need to change message format someday */ |
| -- |
| 2.10.1 |
| |
