linux-kernel - Re: [PATCH] usb: gadget: configfs: Fix OOB read on empty string write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e1ef050c-9679-4571-a4dc-581bf005dab7@gmail.com>
Date: Wed, 9 Jul 2025 11:48:32 +0300
From: Sergey Shtylyov <sergei.shtylyov@...il.com>
To: Xinyu Liu <1171169449@...com>, gregkh@...uxfoundation.org
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
 katieeliu@...cent.com, security@...cent.com
Subject: Re: [PATCH] usb: gadget: configfs: Fix OOB read on empty string write

On 7/9/25 6:55 AM, Xinyu Liu wrote:

> When writing an empty string to either 'qw_sign' or 'landingPage'
> sysfs attributes, the store functions attempt to access page[l - 1]
> before validating that the length 'l' is greater than zero.
> 
> This patch fixes the vulnerability by adding a check at the beginning
> of os_desc_qw_sign_store() and webusb_landingPage_store() to handle
> the zero-length input case gracefully by returning immediately.
> 
> Signed-off-by: Xinyu Liu <katieeliu@...cent.com>
> ---
>  drivers/usb/gadget/configfs.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
> index fba2a56dae97..1bb32d6be9b3 100644
> --- a/drivers/usb/gadget/configfs.c
> +++ b/drivers/usb/gadget/configfs.c
> @@ -1064,7 +1064,8 @@ static ssize_t webusb_landingPage_store(struct config_item *item, const char *pa
>  	struct gadget_info *gi = webusb_item_to_gadget_info(item);
>  	unsigned int bytes_to_strip = 0;
>  	int l = len;
> -

   Why are you removing empty line here?

> +	if (!len)
> +		return len;
>  	if (page[l - 1] == '\n') {
>  		--l;
>  		++bytes_to_strip;
> @@ -1187,7 +1188,8 @@ static ssize_t os_desc_qw_sign_store(struct config_item *item, const char *page,
>  {
>  	struct gadget_info *gi = os_desc_item_to_gadget_info(item);
>  	int res, l;
> -

   And here?

> +	if (!len)
> +		return len;
>  	l = min_t(int, len, OS_STRING_QW_SIGN_LEN >> 1);
>  	if (page[l - 1] == '\n')
>  		--l;

MBR, Sergey