Re: [PATCH] usb: gadget: u_ether: fix out-of-bounds read in get_ether_addr

[Andy Shevchenko <andriy.shevchenko@intel.com>]

On Fri, Oct 23, 2026 at 07:00:59PM +0800, liuc63 wrote:
> get_ether_addr() parses a MAC address string with a fixed six-iteration
> loop, unconditionally calling hex_to_bin() twice per iteration.  It never
> checks for the terminating NUL, so a short string supplied through the
> configfs dev_addr attribute (e.g. "ab") makes the parser read past the
> end of the buffer, triggering a slab-out-of-bounds read reported by
> KASAN.  hex_to_bin() also returns -1 for non-hex characters, which is
> shifted and OR'ed into dev_addr.
> 
> Bail out as soon as the string ends or a non-hex digit is found, routing
> all failure paths through the existing eth_random_addr() fallback so that
> dev_addr is always fully initialized before the function returns.

Instead, in lib/net_utils.c:

bool parse_mac_pton(const char *s, u8 *mac, const char *delim)
{
	...
		if (i != ETH_ALEN - 1 && !strchr(delim, s[i * 3 + 2]))
	...
}

In include/linux/hex.h:

static bool mac_pton(const char *s, u8 *mac)
{
	return parse_mac_pton(s, mac, ":");
}

and here

static int get_ether_addr(const char *str, u8 *dev_addr)
{
        if (str) {
		bool valid;

		valid = parse_mac_pton(str, dev_addr, ".:");
		if (valid && is_valid_ether_addr(dev_addr))
			return 0;
        }
        eth_random_addr(dev_addr);
        return 1;
}

Note, this will require select NET_UTILS in Kconfig to be added.

Make it two patches (first prepares parse_mac_pton() for others to use).

-- 
With Best Regards,
Andy Shevchenko