From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753533Ab1KYVq5 (ORCPT ); Fri, 25 Nov 2011 16:46:57 -0500 Received: from mail-iy0-f174.google.com ([209.85.210.174]:50720 "EHLO mail-iy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752819Ab1KYVq4 (ORCPT ); Fri, 25 Nov 2011 16:46:56 -0500 Message-ID: <4ED00CCB.80604@gmail.com> Date: Fri, 25 Nov 2011 16:46:51 -0500 From: Xi Wang User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0) Gecko/20111105 Thunderbird/8.0 MIME-Version: 1.0 To: Dan Carpenter CC: "devel@driverdev.osuosl.org" , Mori Hess , "security@kernel.org" , Lars-Peter Clausen , Ian Abbott , Lucas De Marchi , Greg Kroah-Hartman , "linux-kernel@vger.kernel.org" , Ian Abbott , Franky Lin , Greg Dietsche , Mark Pearson Subject: [PATCH v3] comedi: integer overflow in do_insnlist_ioctl() References: <5C0D372F-F03E-4EB8-8440-83A8D1C95363@gmail.com> <20111123061355.GA3295@mwanda> <20111123145020.GA3258@mwanda> <4ECD1A01.3060503@mev.co.uk> <4ECD6873.7080106@metafoo.de> <20111123215111.GD3258@mwanda> <97189E06-26D8-4CF9-B325-06403FB1C42C@gmail.com> <20111125072550.GK3195@mwanda> In-Reply-To: <20111125072550.GK3195@mwanda> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org There is a potential integer overflow in do_insnlist_ioctl() if userspace passes in a large insnlist.n_insns. The call to kmalloc() would allocate a small buffer, leading to a memory corruption. The bug was reported by Dan Carpenter and Haogang Chen . The patch was suggested by Ian Abbott and Lars-Peter Clausen . Signed-off-by: Xi Wang --- drivers/staging/comedi/comedi_fops.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c index 21d8c1c..7f7d79e 100644 --- a/drivers/staging/comedi/comedi_fops.c +++ b/drivers/staging/comedi/comedi_fops.c @@ -671,7 +671,7 @@ static int do_insnlist_ioctl(struct comedi_device *dev, } insns = - kmalloc(sizeof(struct comedi_insn) * insnlist.n_insns, GFP_KERNEL); + kcalloc(insnlist.n_insns, sizeof(struct comedi_insn), GFP_KERNEL); if (!insns) { DPRINTK("kmalloc failed\n"); ret = -ENOMEM; -- 1.7.5.4