| | Date | Mon, 25 Apr 2011 22:03:41 +0200 | | From | Willy Tarreau <> | | Subject | [PATCH 069/173] usb: iowarrior: dont trust report_size for buffer size |
| |
2.6.27.59-stable review patch. If anyone has any objections, please let us know.
------------------ From: Kees Cook <kees.cook@canonical.com>
commit 3ed780117dbe5acb64280d218f0347f238dafed0 upstream.
If the iowarrior devices in this case statement support more than 8 bytes per report, it is possible to write past the end of a kernel heap allocation. This will probably never be possible, but change the allocation to be more defensive anyway.
Signed-off-by: Kees Cook <kees.cook@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Acked-by: Brandon Philips <bphilips@suse.de>
--- drivers/usb/misc/iowarrior.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/misc/iowarrior.c +++ b/drivers/usb/misc/iowarrior.c @@ -373,7 +373,7 @@ static ssize_t iowarrior_write(struct fi case USB_DEVICE_ID_CODEMERCS_IOWPV2: case USB_DEVICE_ID_CODEMERCS_IOW40: /* IOW24 and IOW40 use a synchronous call */ - buf = kmalloc(8, GFP_KERNEL); /* 8 bytes are enough for both products */ + buf = kmalloc(count, GFP_KERNEL); if (!buf) { retval = -ENOMEM; goto exit;
|