Commit 08ae4b20 authored by Ian Abbott's avatar Ian Abbott Committed by Greg Kroah-Hartman
Browse files

comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large 



The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to
hold the array of `struct comedi_insn`, getting the length from the
`n_insns` member of the `struct comedi_insnlist` supplied by the user.
The allocation will fail with a WARNING and a stack dump if it is too
large.

Avoid that by failing with an `-EINVAL` error if the supplied `n_insns`
value is unreasonable.

Define the limit on the `n_insns` value in the `MAX_INSNS` macro.  Set
this to the same value as `MAX_SAMPLES` (65536), which is the maximum
allowed sum of the values of the member `n` in the array of `struct
comedi_insn`, and sensible comedi instructions will have an `n` of at
least 1.

Reported-by: default avatar <syzbot+d6995b62e5ac7d79557a@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=d6995b62e5ac7d79557a


Fixes: ed9eccbe ("Staging: add comedi core")
Tested-by: default avatarIan Abbott <abbotti@mev.co.uk>
Cc: stable@vger.kernel.org # 5.13+
Signed-off-by: default avatarIan Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20250704120405.83028-1-abbotti@mev.co.uk


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 2aa4ad62

drivers/comedi/comedi_fops.c

+16 −0
Original line number Diff line number Diff line
@@ -1589,6 +1589,16 @@ static int do_insnlist_ioctl(struct comedi_device *dev, 
	return i;

}



#define MAX_INSNS   MAX_SAMPLES

static int check_insnlist_len(struct comedi_device *dev, unsigned int n_insns)

{

	if (n_insns > MAX_INSNS) {

		dev_dbg(dev->class_dev, "insnlist length too large\n");

		return -EINVAL;

	}

	return 0;

}



/*

 * COMEDI_INSN ioctl

 * synchronous instruction
@@ -2239,6 +2249,9 @@ static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd, 
			rc = -EFAULT;

			break;

		}

		rc = check_insnlist_len(dev, insnlist.n_insns);

		if (rc)

			break;

		insns = kcalloc(insnlist.n_insns, sizeof(*insns), GFP_KERNEL);

		if (!insns) {

			rc = -ENOMEM;
@@ -3142,6 +3155,9 @@ static int compat_insnlist(struct file *file, unsigned long arg) 
	if (copy_from_user(&insnlist32, compat_ptr(arg), sizeof(insnlist32)))

		return -EFAULT;



	rc = check_insnlist_len(dev, insnlist32.n_insns);

	if (rc)

		return rc;

	insns = kcalloc(insnlist32.n_insns, sizeof(*insns), GFP_KERNEL);

	if (!insns)

		return -ENOMEM;