openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

USB: usblcd doesn't limit memory consumption during write 

usblcd currently has no way to limit memory consumption by fast writers.
This is a security problem, as it allows users with write access to this
device to drive the system into oom despite resource limits.
Here's the fix taken from the modern skeleton driver.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Oliver Neukum 2007-06-11 15:36:02 +02:00 committed by Greg Kroah-Hartman
parent fc0f8fc9be
commit 5afeb104e7
1 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/usb/misc/usblcd.c
View File

@ -42,10 +42,14 @@ struct usb_lcd {
size_t bulk_in_size; /* the size of the receive buffer */ size_t bulk_in_size; /* the size of the receive buffer */
__u8 bulk_in_endpointAddr; /* the address of the bulk in endpoint */ __u8 bulk_in_endpointAddr; /* the address of the bulk in endpoint */
__u8 bulk_out_endpointAddr; /* the address of the bulk out endpoint */ __u8 bulk_out_endpointAddr; /* the address of the bulk out endpoint */
struct kref kref; struct kref kref;
struct semaphore limit_sem; /* to stop writes at full throttle from
* using up all RAM */
}; };
#define to_lcd_dev(d) container_of(d, struct usb_lcd, kref) #define to_lcd_dev(d) container_of(d, struct usb_lcd, kref)
#define USB_LCD_CONCURRENT_WRITES 5
static struct usb_driver lcd_driver; static struct usb_driver lcd_driver;
static DEFINE_MUTEX(usb_lcd_open_mutex); static DEFINE_MUTEX(usb_lcd_open_mutex);
@ -186,12 +190,13 @@ static void lcd_write_bulk_callback(struct urb *urb)
/* free up our allocated buffer */ /* free up our allocated buffer */
usb_buffer_free(urb->dev, urb->transfer_buffer_length, usb_buffer_free(urb->dev, urb->transfer_buffer_length,
urb->transfer_buffer, urb->transfer_dma); urb->transfer_buffer, urb->transfer_dma);
up(&dev->limit_sem);
} }
static ssize_t lcd_write(struct file *file, const char __user * user_buffer, size_t count, loff_t *ppos) static ssize_t lcd_write(struct file *file, const char __user * user_buffer, size_t count, loff_t *ppos)
{ {
struct usb_lcd *dev; struct usb_lcd *dev;
int retval = 0; int retval = 0, r;
struct urb *urb = NULL; struct urb *urb = NULL;
char *buf = NULL; char *buf = NULL;
@ -201,10 +206,16 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer, siz
if (count == 0) if (count == 0)
goto exit; goto exit;
r = down_interruptible(&dev->limit_sem);
if (r < 0)
return -EINTR;
/* create a urb, and a buffer for it, and copy the data to the urb */ /* create a urb, and a buffer for it, and copy the data to the urb */
urb = usb_alloc_urb(0, GFP_KERNEL); urb = usb_alloc_urb(0, GFP_KERNEL);
if (!urb) if (!urb) {
return -ENOMEM; retval = -ENOMEM;
goto err_no_buf;
}
buf = usb_buffer_alloc(dev->udev, count, GFP_KERNEL, &urb->transfer_dma); buf = usb_buffer_alloc(dev->udev, count, GFP_KERNEL, &urb->transfer_dma);
if (!buf) { if (!buf) {
@ -239,6 +250,8 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer, siz
error: error:
usb_buffer_free(dev->udev, count, buf, urb->transfer_dma); usb_buffer_free(dev->udev, count, buf, urb->transfer_dma);
usb_free_urb(urb); usb_free_urb(urb);
err_no_buf:
up(&dev->limit_sem);
return retval; return retval;
} }
@ -277,6 +290,7 @@ static int lcd_probe(struct usb_interface *interface, const struct usb_device_id
goto error; goto error;
} }
kref_init(&dev->kref); kref_init(&dev->kref);
sema_init(&dev->limit_sem, USB_LCD_CONCURRENT_WRITES);
dev->udev = usb_get_dev(interface_to_usbdev(interface)); dev->udev = usb_get_dev(interface_to_usbdev(interface));
dev->interface = interface; dev->interface = interface;