]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
usb: gadget: configfs: Fix OOB read on empty string write
authorXinyu Liu <1171169449@qq.com>
Wed, 9 Jul 2025 03:55:33 +0000 (11:55 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Jul 2025 10:10:52 +0000 (12:10 +0200)
commit3014168731b7930300aab656085af784edc861f6
tree7ade519ceade7a99e026a32d7d16ceda5c5ad16c
parent67a59f82196c8c4f50c83329f0577acfb1349b50
usb: gadget: configfs: Fix OOB read on empty string write

When writing an empty string to either 'qw_sign' or 'landingPage'
sysfs attributes, the store functions attempt to access page[l - 1]
before validating that the length 'l' is greater than zero.

This patch fixes the vulnerability by adding a check at the beginning
of os_desc_qw_sign_store() and webusb_landingPage_store() to handle
the zero-length input case gracefully by returning immediately.

Signed-off-by: Xinyu Liu <katieeliu@tencent.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/tencent_B1C9481688D0E95E7362AB2E999DE8048207@qq.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/configfs.c