]> www.infradead.org Git - users/dwmw2/linux.git/commit
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
authorLee Jones <lee@kernel.org>
Fri, 5 Jul 2024 07:43:39 +0000 (08:43 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 5 Jul 2024 07:57:24 +0000 (09:57 +0200)
commit6d3c721e686ea6c59e18289b400cc95c76e927e0
tree09b319a96730f64eefebf29dcbe2cec37a66343f
parent2bf35ea46d0bc379c456e14c0ec1dc1e003b39f1
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()

Userspace provided string 's' could trivially have the length zero. Left
unchecked this will firstly result in an OOB read in the form
`if (str[0 - 1] == '\n') followed closely by an OOB write in the form
`str[0 - 1] = '\0'`.

There is already a validating check to catch strings that are too long.
Let's supply an additional check for invalid strings that are too short.

Signed-off-by: Lee Jones <lee@kernel.org>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/configfs.c