[PATCH] usb: gadget: f_printer: clamp GET_DEVICE_ID pnp_string to ep0 buffer

[PATCH] usb: gadget: f_printer: clamp GET_DEVICE_ID pnp_string to ep0 buffer

[Fang Xieyan]

The GET_DEVICE_ID request handler in printer_func_setup() copies
the configfs-provided pnp_string into the EP0 request buffer.

The pnp_string length is bounded by the configfs page size, but
is not limited by the size of the EP0 buffer. Since the first
two bytes of the buffer are used for the length field, a
pnp_string longer than USB_COMP_EP0_BUFSIZ - 2 causes memcpy()
to write beyond the end of the EP0 buffer.

Limit the copied string length to USB_COMP_EP0_BUFSIZ - 2,
ensuring that both the length field and the string fit within
the EP0 buffer.

Fixes: 24b7ba2f88e0 ("usb: gadget: function: fix dangling pnp_string in f_printer.c")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
 drivers/usb/gadget/function/f_printer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index d295ade8f..17ccce78d 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -1022,7 +1022,8 @@ static int printer_func_setup(struct usb_function *f,
 				value = 0;
 				break;
 			}
-			value = strlen(*dev->pnp_string);
+			value = min_t(int, strlen(*dev->pnp_string),
+				      USB_COMP_EP0_BUFSIZ - 2);
 			buf[0] = (value >> 8) & 0xFF;
 			buf[1] = value & 0xFF;
 			memcpy(buf + 2, *dev->pnp_string, value);
--
2.50.1

Re: [PATCH] usb: gadget: f_printer: clamp GET_DEVICE_ID pnp_string to ep0 buffer

[sashiko-bot]

> The GET_DEVICE_ID request handler in printer_func_setup() copies
> the configfs-provided pnp_string into the EP0 request buffer.
> 
> The pnp_string length is bounded by the configfs page size, but
> is not limited by the size of the EP0 buffer. Since the first
> two bytes of the buffer are used for the length field, a
> pnp_string longer than USB_COMP_EP0_BUFSIZ - 2 causes memcpy()
> to write beyond the end of the EP0 buffer.
> 
> Limit the copied string length to USB_COMP_EP0_BUFSIZ - 2,
> ensuring that both the length field and the string fit within
> the EP0 buffer.
> 
> Fixes: 24b7ba2f88e0 ("usb: gadget: function: fix dangling pnp_string in f_printer.c")
> Cc: stable@vger.kernel.org
> Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
> Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105092712.27838-1-fangxy@xiaopeng.com?part=1