Skip to content
Commit cb84f568 authored by Dan Carpenter's avatar Dan Carpenter Committed by Felipe Balbi
Browse files

usb: misc: usbtest: Fix overflow in usbtest_do_ioctl()



There used to be a test against "if (param->sglen > MAX_SGLEN)" but it
was removed during a refactor.  It leads to an integer overflow and a
stack overflow in test_queue() if we try to create a too large urbs[]
array on the stack.

There is a second integer overflow in test_queue() as well if
"param->iterations" is too high.  I don't immediately see that it's
harmful but I've added a check to prevent it and silence the static
checker warning.

Fixes: 18fc4ebd ("usb: misc: usbtest: Remove timeval usage")
Acked-by: default avatarDeepa Dinamani <deepa.kernel@gmail.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent 29c7f3e6
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment