diff mbox series

usb: gadget: f_fs: stricter integer overflow checks

Message ID YxDI3lMYomE7WCjn@kili (mailing list archive)
State Accepted
Commit f57004b9d96755cd6a243b51c267be4016b4563c
Headers show
Series usb: gadget: f_fs: stricter integer overflow checks | expand

Commit Message

Dan Carpenter Sept. 1, 2022, 2:59 p.m. UTC 
This from static analysis.  The vla_item() takes a size and adds it to
the total.  It has a built in integer overflow check so if it encounters
an integer overflow anywhere then it records the total as SIZE_MAX.

However there is an issue here because the "lang_count*(needed_count+1)"
multiplication can overflow.  Technically the "lang_count + 1" addition
could overflow too, but that would be detected and is harmless.  Fix
both using the new size_add() and size_mul() functions.

Fixes: e6f3862fa1ec ("usb: gadget: FunctionFS: Remove VLAIS usage from gadget code")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
The Fixes tag is arguably incorrect.  Sometimes it is a philosophical
question how to assign the Fixes tag.  That was the patch which added
checking for integer overflows.  So that patch only made things better,
but it accidentally left this from the original code.

From a practical perspective, that patch is nine years old and anyone
who hasn't applied it doesn't care about security.

 drivers/usb/gadget/function/f_fs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 98dc2291e9a1..73dc10a77cde 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2645,10 +2645,10 @@  static int __ffs_data_got_strings(struct ffs_data *ffs,
 		unsigned i = 0;
 		vla_group(d);
 		vla_item(d, struct usb_gadget_strings *, stringtabs,
-			lang_count + 1);
+			size_add(lang_count, 1));
 		vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
 		vla_item(d, struct usb_string, strings,
-			lang_count*(needed_count+1));
+			size_mul(lang_count, (needed_count + 1)));
 
 		char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);