Re: [PATCH] drivers: Two potential integer overflow in sbp_make_tpg() and usbg_make_tpg()

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Apr 10, 2025 at 10:05:49PM +0800, Chen Yufeng wrote:
> The variable tpgt in sbp_make_tpg() and usbg_make_tpg() is defined as
> unsigned long and is assigned to tpgt->tport_tpgt, which is defined as u16.
> This may cause an integer overflow when tpgt is greater than USHRT_MAX
> (65535). 

Can that actually ever happen?

If so, why not just fix up "tpgt" to be u16?

> My fix is based on the implementation of tcm_qla2xxx_make_tpg() in 
> drivers/scsi/qla2xxx/tcm_qla2xxx.c which limits tpgt to USHRT_MAX.

Again, why not restrict the size of the variable to start with?


> 
> This patch is similar to
> commit 59c816c1f24d ("vhost/scsi: potential memory corruption").
> 
> Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
> ---
>  drivers/target/sbp/sbp_target.c     | 2 +-
>  drivers/usb/gadget/function/f_tcm.c | 2 +-

You have to split this into two different patches as it goes through two
different trees before we could take it.

thanks,

greg k-h