Re: [PATCH] usb: gadget: f_printer: clamp GET_DEVICE_ID pnp_string to ep0 buffer

[sashiko-bot@kernel.org]

> The GET_DEVICE_ID request handler in printer_func_setup() copies
> the configfs-provided pnp_string into the EP0 request buffer.
> 
> The pnp_string length is bounded by the configfs page size, but
> is not limited by the size of the EP0 buffer. Since the first
> two bytes of the buffer are used for the length field, a
> pnp_string longer than USB_COMP_EP0_BUFSIZ - 2 causes memcpy()
> to write beyond the end of the EP0 buffer.
> 
> Limit the copied string length to USB_COMP_EP0_BUFSIZ - 2,
> ensuring that both the length field and the string fit within
> the EP0 buffer.
> 
> Fixes: 24b7ba2f88e0 ("usb: gadget: function: fix dangling pnp_string in f_printer.c")
> Cc: stable@vger.kernel.org
> Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
> Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105092712.27838-1-fangxy@xiaopeng.com?part=1