Re: [PATCH] usb: gadget: net2280: fix out-of-bounds read of short packet in write_fifo

[sashiko-bot@kernel.org]

> From: Liu Chao <liuc63@xiaopeng.com>
> 
> write_fifo() handles the trailing short word of an IN transfer by
> reading a full 32-bit word from req->buf even when only 1..3 bytes
> remain. get_unaligned((u32 *)buf) therefore reads up to three bytes
> past the end of the request buffer, which KASAN reports as a
> slab-out-of-bounds read.
> 
> The over-read bytes are not sent to the host: set_fifo_bytecount()
> limits the FIFO to count & 0x03 bytes, so this is an out-of-bounds read
> rather than an information leak.
> 
> Copy the remaining 1..3 bytes into a zero-padded word and feed that to
> the existing get_unaligned()/cpu_to_le32s() sequence, so the trailing
> word is built only from data that belongs to the request. The full-word
> path above is unchanged, and reusing get_unaligned()/cpu_to_le32s()
> keeps the byte order identical on both little- and big-endian hosts.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019075651.2093625-1-liuc63@xiaopeng.com?part=1