From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756033AbcARRFA (ORCPT ); Mon, 18 Jan 2016 12:05:00 -0500 Received: from mail-yk0-f179.google.com ([209.85.160.179]:35087 "EHLO mail-yk0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755987AbcARREz (ORCPT ); Mon, 18 Jan 2016 12:04:55 -0500 From: Insu Yun To: gregkh@linuxfoundation.org, stefan.koch10@gmail.com, stern@rowland.harvard.edu, kborer@gmail.com, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Cc: taesoo@gatech.edu, yeongjin.jang@gatech.edu, insu@gatech.edu, changwoo@gatech.edu, Insu Yun Subject: [PATCH] usb: fix potential integer overflow in usb_sg_init Date: Mon, 18 Jan 2016 12:06:51 -0500 Message-Id: <1453136811-15601-1-git-send-email-wuninsu@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If nents value is sufficient large, e.g 0x40000000, then it can overflow size in kmalloc and heap overflow happesns. Therefore nents value needs to be checked to prevent overflow. Signed-off-by: Insu Yun --- drivers/usb/core/message.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index 8e641b5..53393d5 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -367,7 +367,8 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev, if (!io || !dev || !sg || usb_pipecontrol(pipe) || usb_pipeisoc(pipe) - || nents <= 0) + || nents <= 0 + || nents >= UINT_MAX / sizeof(*io->urbs)) return -EINVAL; spin_lock_init(&io->lock); -- 1.9.1