[PATCH] usb: gadget: net2280: fix out-of-bounds read of short packet in write_fifo

[PATCH] usb: gadget: net2280: fix out-of-bounds read of short packet in write_fifo

[liuc63]

From: Liu Chao <liuc63@xiaopeng.com>

write_fifo() handles the trailing short word of an IN transfer by
reading a full 32-bit word from req->buf even when only 1..3 bytes
remain. get_unaligned((u32 *)buf) therefore reads up to three bytes
past the end of the request buffer, which KASAN reports as a
slab-out-of-bounds read.

The over-read bytes are not sent to the host: set_fifo_bytecount()
limits the FIFO to count & 0x03 bytes, so this is an out-of-bounds read
rather than an information leak.

Copy the remaining 1..3 bytes into a zero-padded word and feed that to
the existing get_unaligned()/cpu_to_le32s() sequence, so the trailing
word is built only from data that belongs to the request. The full-word
path above is unchanged, and reusing get_unaligned()/cpu_to_le32s()
keeps the byte order identical on both little- and big-endian hosts.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/udc/net2280.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 7c5f30cfd24d..a1f5d11f82d2 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -649,7 +649,18 @@ static void write_fifo(struct net2280_ep *ep, struct usb_request *req)
 	 * when maxpacket is not a multiple of 4 bytes.
 	 */
 	if (count || total < ep->ep.maxpacket) {
-		tmp = count ? get_unaligned((u32 *)buf) : count;
+		/*
+		 * Don't read past the end of the request buffer: a short
+		 * trailing packet has only count & 0x03 valid bytes. Copy
+		 * them into a zero-padded word and reuse the same
+		 * get_unaligned()/cpu_to_le32s() sequence as the full-word
+		 * path above, so the byte order on the wire is unchanged.
+		 */
+		u8 tail[4] = {};
+
+		if (count)
+			memcpy(tail, buf, count & 0x03);
+		tmp = get_unaligned((u32 *)tail);
 		cpu_to_le32s(&tmp);
 		set_fifo_bytecount(ep, count & 0x03);
 		writel(tmp, &regs->ep_data);
-- 
2.50.1

Re: [PATCH] usb: gadget: net2280: fix out-of-bounds read of short packet in write_fifo

[sashiko-bot]

> From: Liu Chao <liuc63@xiaopeng.com>
> 
> write_fifo() handles the trailing short word of an IN transfer by
> reading a full 32-bit word from req->buf even when only 1..3 bytes
> remain. get_unaligned((u32 *)buf) therefore reads up to three bytes
> past the end of the request buffer, which KASAN reports as a
> slab-out-of-bounds read.
> 
> The over-read bytes are not sent to the host: set_fifo_bytecount()
> limits the FIFO to count & 0x03 bytes, so this is an out-of-bounds read
> rather than an information leak.
> 
> Copy the remaining 1..3 bytes into a zero-padded word and feed that to
> the existing get_unaligned()/cpu_to_le32s() sequence, so the trailing
> word is built only from data that belongs to the request. The full-word
> path above is unchanged, and reusing get_unaligned()/cpu_to_le32s()
> keeps the byte order identical on both little- and big-endian hosts.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019075651.2093625-1-liuc63@xiaopeng.com?part=1

Re: [PATCH] usb: gadget: net2280: fix out-of-bounds read of short packet in write_fifo

[Alan Stern]

On Mon, Oct 19, 2026 at 03:56:49PM +0800, liuc63 wrote:
> From: Liu Chao <liuc63@xiaopeng.com>
> 
> write_fifo() handles the trailing short word of an IN transfer by
> reading a full 32-bit word from req->buf even when only 1..3 bytes
> remain. get_unaligned((u32 *)buf) therefore reads up to three bytes
> past the end of the request buffer, which KASAN reports as a
> slab-out-of-bounds read.
> 
> The over-read bytes are not sent to the host: set_fifo_bytecount()
> limits the FIFO to count & 0x03 bytes, so this is an out-of-bounds read
> rather than an information leak.
> 
> Copy the remaining 1..3 bytes into a zero-padded word and feed that to
> the existing get_unaligned()/cpu_to_le32s() sequence, so the trailing
> word is built only from data that belongs to the request. The full-word
> path above is unchanged, and reusing get_unaligned()/cpu_to_le32s()
> keeps the byte order identical on both little- and big-endian hosts.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
> ---
>  drivers/usb/gadget/udc/net2280.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
> index 7c5f30cfd24d..a1f5d11f82d2 100644
> --- a/drivers/usb/gadget/udc/net2280.c
> +++ b/drivers/usb/gadget/udc/net2280.c
> @@ -649,7 +649,18 @@ static void write_fifo(struct net2280_ep *ep, struct usb_request *req)
>  	 * when maxpacket is not a multiple of 4 bytes.
>  	 */
>  	if (count || total < ep->ep.maxpacket) {
> -		tmp = count ? get_unaligned((u32 *)buf) : count;
> +		/*
> +		 * Don't read past the end of the request buffer: a short
> +		 * trailing packet has only count & 0x03 valid bytes. Copy
> +		 * them into a zero-padded word and reuse the same
> +		 * get_unaligned()/cpu_to_le32s() sequence as the full-word
> +		 * path above, so the byte order on the wire is unchanged.
> +		 */
> +		u8 tail[4] = {};
> +
> +		if (count)
> +			memcpy(tail, buf, count & 0x03);
> +		tmp = get_unaligned((u32 *)tail);
>  		cpu_to_le32s(&tmp);

Wouldn't it be simpler to do the memcpy() directly into tmp?  Then the 
get_unaligned() call wouldn't be needed at all.  Also, the big comment 
would be unnecessary.

Alan Stern

>  		set_fifo_bytecount(ep, count & 0x03);
>  		writel(tmp, &regs->ep_data);
> -- 
> 2.50.1
> 
>