diff options
| author | Dan Carpenter <[email protected]> | 2017-09-30 08:15:29 +0000 |
|---|---|---|
| committer | Felipe Balbi <[email protected]> | 2017-10-11 10:14:09 +0000 |
| commit | cb84f56861eb333af0a5bab475d741b13067c05c (patch) | |
| tree | d74aad2ca497cf19faeca8e6f9a6e3071ac46c3b /tools/perf/scripts/python/syscall-counts.py | |
| parent | usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet (diff) | |
| download | kernel-cb84f56861eb333af0a5bab475d741b13067c05c.tar.gz kernel-cb84f56861eb333af0a5bab475d741b13067c05c.zip | |
usb: misc: usbtest: Fix overflow in usbtest_do_ioctl()
There used to be a test against "if (param->sglen > MAX_SGLEN)" but it
was removed during a refactor. It leads to an integer overflow and a
stack overflow in test_queue() if we try to create a too large urbs[]
array on the stack.
There is a second integer overflow in test_queue() as well if
"param->iterations" is too high. I don't immediately see that it's
harmful but I've added a check to prevent it and silence the static
checker warning.
Fixes: 18fc4ebdc705 ("usb: misc: usbtest: Remove timeval usage")
Acked-by: Deepa Dinamani <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Felipe Balbi <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/syscall-counts.py')
0 files changed, 0 insertions, 0 deletions