mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-04 08:17:46 +00:00
cb84f56861
There used to be a test against "if (param->sglen > MAX_SGLEN)" but it
was removed during a refactor. It leads to an integer overflow and a
stack overflow in test_queue() if we try to create a too large urbs[]
array on the stack.
There is a second integer overflow in test_queue() as well if
"param->iterations" is too high. I don't immediately see that it's
harmful but I've added a check to prevent it and silence the static
checker warning.
Fixes:
|
||
|---|---|---|
| .. | ||
| sisusbvga | ||
| adutux.c | ||
| appledisplay.c | ||
| chaoskey.c | ||
| cypress_cy7c63.c | ||
| cytherm.c | ||
| ehset.c | ||
| emi26.c | ||
| emi62.c | ||
| ezusb.c | ||
| ftdi-elan.c | ||
| idmouse.c | ||
| iowarrior.c | ||
| isight_firmware.c | ||
| Kconfig | ||
| ldusb.c | ||
| legousbtower.c | ||
| lvstest.c | ||
| Makefile | ||
| rio500.c | ||
| rio500_usb.h | ||
| trancevibrator.c | ||
| usb251xb.c | ||
| usb3503.c | ||
| usb4604.c | ||
| usb_u132.h | ||
| usblcd.c | ||
| usbsevseg.c | ||
| usbtest.c | ||
| uss720.c | ||
| yurex.c | ||