[PATCH] usb: gadget: u_ether: fix out-of-bounds read in get_ether_addr

[PATCH] usb: gadget: u_ether: fix out-of-bounds read in get_ether_addr

[liuc63]

get_ether_addr() parses a MAC address string with a fixed six-iteration
loop, unconditionally calling hex_to_bin() twice per iteration.  It never
checks for the terminating NUL, so a short string supplied through the
configfs dev_addr attribute (e.g. "ab") makes the parser read past the
end of the buffer, triggering a slab-out-of-bounds read reported by
KASAN.  hex_to_bin() also returns -1 for non-hex characters, which is
shifted and OR'ed into dev_addr.

Bail out as soon as the string ends or a non-hex digit is found, routing
all failure paths through the existing eth_random_addr() fallback so that
dev_addr is always fully initialized before the function returns.

Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
Cc: stable@vger.kernel.org
Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/function/u_ether.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 59d85d6a84a8..12edad59ddc3 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -689,17 +689,26 @@ static int get_ether_addr(const char *str, u8 *dev_addr)
 		unsigned	i;
 
 		for (i = 0; i < 6; i++) {
-			unsigned char num;
+			int hi, lo;
 
+			if (!*str)
+				goto fail;
 			if ((*str == '.') || (*str == ':'))
 				str++;
-			num = hex_to_bin(*str++) << 4;
-			num |= hex_to_bin(*str++);
-			dev_addr [i] = num;
+			if (!*str)
+				goto fail;
+			hi = hex_to_bin(*str++);
+			if (hi < 0 || !*str)
+				goto fail;
+			lo = hex_to_bin(*str++);
+			if (lo < 0)
+				goto fail;
+			dev_addr[i] = (hi << 4) | lo;
 		}
 		if (is_valid_ether_addr(dev_addr))
 			return 0;
 	}
+fail:
 	eth_random_addr(dev_addr);
 	return 1;
 }
-- 
2.50.1

Re: [PATCH] usb: gadget: u_ether: fix out-of-bounds read in get_ether_addr

[sashiko-bot]

> get_ether_addr() parses a MAC address string with a fixed six-iteration
> loop, unconditionally calling hex_to_bin() twice per iteration.  It never
> checks for the terminating NUL, so a short string supplied through the
> configfs dev_addr attribute (e.g. "ab") makes the parser read past the
> end of the buffer, triggering a slab-out-of-bounds read reported by
> KASAN.  hex_to_bin() also returns -1 for non-hex characters, which is
> shifted and OR'ed into dev_addr.
> 
> Bail out as soon as the string ends or a non-hex digit is found, routing
> all failure paths through the existing eth_random_addr() fallback so that
> dev_addr is always fully initialized before the function returns.
> 
> Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
> Cc: stable@vger.kernel.org
> Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023110113.2969708-1-liuc63@xiaopeng.com?part=1

Re: [PATCH] usb: gadget: u_ether: fix out-of-bounds read in get_ether_addr

[Andy Shevchenko]

On Fri, Oct 23, 2026 at 07:00:59PM +0800, liuc63 wrote:
> get_ether_addr() parses a MAC address string with a fixed six-iteration
> loop, unconditionally calling hex_to_bin() twice per iteration.  It never
> checks for the terminating NUL, so a short string supplied through the
> configfs dev_addr attribute (e.g. "ab") makes the parser read past the
> end of the buffer, triggering a slab-out-of-bounds read reported by
> KASAN.  hex_to_bin() also returns -1 for non-hex characters, which is
> shifted and OR'ed into dev_addr.
> 
> Bail out as soon as the string ends or a non-hex digit is found, routing
> all failure paths through the existing eth_random_addr() fallback so that
> dev_addr is always fully initialized before the function returns.

Instead, in lib/net_utils.c:

bool parse_mac_pton(const char *s, u8 *mac, const char *delim)
{
	...
		if (i != ETH_ALEN - 1 && !strchr(delim, s[i * 3 + 2]))
	...
}

In include/linux/hex.h:

static bool mac_pton(const char *s, u8 *mac)
{
	return parse_mac_pton(s, mac, ":");
}

and here

static int get_ether_addr(const char *str, u8 *dev_addr)
{
        if (str) {
		bool valid;

		valid = parse_mac_pton(str, dev_addr, ".:");
		if (valid && is_valid_ether_addr(dev_addr))
			return 0;
        }
        eth_random_addr(dev_addr);
        return 1;
}

Note, this will require select NET_UTILS in Kconfig to be added.

Make it two patches (first prepares parse_mac_pton() for others to use).

-- 
With Best Regards,
Andy Shevchenko