Skip to content

Commit 53809d3

Browse files
andy-shevgregkh
authored andcommitted
usb: Add checks for snprintf() calls in usb_alloc_dev()
[ Upstream commit 82fe510 ] When creating a device path in the driver the snprintf() takes up to 16 characters long argument along with the additional up to 12 characters for the signed integer (as it can't see the actual limits) and tries to pack this into 16 bytes array. GCC complains about that when build with `make W=1`: drivers/usb/core/usb.c:705:25: note: ‘snprintf’ output between 3 and 28 bytes into a destination of size 16 Since everything works until now, let's just check for the potential buffer overflow and bail out. It is most likely a never happen situation, but at least it makes GCC happy. Signed-off-by: Andy Shevchenko <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
1 parent 4fb6703 commit 53809d3

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

drivers/usb/core/usb.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -695,15 +695,16 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
695695
device_set_of_node_from_dev(&dev->dev, bus->sysdev);
696696
dev_set_name(&dev->dev, "usb%d", bus->busnum);
697697
} else {
698+
int n;
699+
698700
/* match any labeling on the hubs; it's one-based */
699701
if (parent->devpath[0] == '0') {
700-
snprintf(dev->devpath, sizeof dev->devpath,
701-
"%d", port1);
702+
n = snprintf(dev->devpath, sizeof(dev->devpath), "%d", port1);
702703
/* Root ports are not counted in route string */
703704
dev->route = 0;
704705
} else {
705-
snprintf(dev->devpath, sizeof dev->devpath,
706-
"%s.%d", parent->devpath, port1);
706+
n = snprintf(dev->devpath, sizeof(dev->devpath), "%s.%d",
707+
parent->devpath, port1);
707708
/* Route string assumes hubs have less than 16 ports */
708709
if (port1 < 15)
709710
dev->route = parent->route +
@@ -712,6 +713,11 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
712713
dev->route = parent->route +
713714
(15 << ((parent->level - 1)*4));
714715
}
716+
if (n >= sizeof(dev->devpath)) {
717+
usb_put_hcd(bus_to_hcd(bus));
718+
usb_put_dev(dev);
719+
return NULL;
720+
}
715721

716722
dev->dev.parent = &parent->dev;
717723
dev_set_name(&dev->dev, "%d-%s", bus->busnum, dev->devpath);

0 commit comments

Comments
 (0)