Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0994b0a2 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Felipe Balbi
Browse files

usb: gadgetfs: restrict upper bound on device configuration size 



Andrey Konovalov reported that we were not properly checking the upper
limit before of a device configuration size before calling
memdup_user(), which could cause some problems.

So set the upper limit to PAGE_SIZE * 4, which should be good enough for
all devices.

Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent bcdbeb84

drivers/usb/gadget/legacy/inode.c

+2 −1
Original line number Diff line number Diff line
@@ -1762,7 +1762,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) 
	}

	spin_unlock_irq(&dev->lock);



	if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))

	if ((len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) ||

	    (len > PAGE_SIZE * 4))

		return -EINVAL;



	/* we might need to change message format someday */