tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()

The `check_command_size_in_blocks()` function calculates the data size
in bytes by left shifting `common->data_size_from_cmnd` by the block
size (`common->curlun->blkbits`). However, it does not validate whether
this shift operation will cause an integer overflow.

Initially, the block size is set up in `fsg_lun_open()` , and the
`common->data_size_from_cmnd` is set up in `do_scsi_command()`. During
initialization, there is no integer overflow check for the interaction
between two variables.

So if a malicious USB host sends a SCSI READ or WRITE command
requesting a large amount of data (`common->data_size_from_cmnd`), the
left shift operation can wrap around. This results in a truncated data
size, which can bypass boundary checks and potentially lead to memory
corruption or out-of-bounds accesses.

Fix this by using the check_shl_overflow() macro to safely perform the
shift and catch any overflows.

Fixes: 144974e7f9e3 ("usb: gadget: mass_storage: support multi-luns with different logic block size")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260228104324.1696455-2-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Seungjin Bae and committed by
Greg Kroah-Hartman 8479891d 7f58b414

+10 -2
+10 -2
drivers/usb/gadget/function/f_mass_storage.c
··· 180 180 #include <linux/kthread.h> 181 181 #include <linux/sched/signal.h> 182 182 #include <linux/limits.h> 183 + #include <linux/overflow.h> 183 184 #include <linux/pagemap.h> 184 185 #include <linux/rwsem.h> 185 186 #include <linux/slab.h> ··· 1854 1853 int cmnd_size, enum data_direction data_dir, 1855 1854 unsigned int mask, int needs_medium, const char *name) 1856 1855 { 1857 - if (common->curlun) 1858 - common->data_size_from_cmnd <<= common->curlun->blkbits; 1856 + if (common->curlun) { 1857 + if (check_shl_overflow(common->data_size_from_cmnd, 1858 + common->curlun->blkbits, 1859 + &common->data_size_from_cmnd)) { 1860 + common->phase_error = 1; 1861 + return -EINVAL; 1862 + } 1863 + } 1864 + 1859 1865 return check_command(common, cmnd_size, data_dir, 1860 1866 mask, needs_medium, name); 1861 1867 }