Re: [PATCH] usb: gadget: u_ether: fix out-of-bounds read in get_ether_addr

[sashiko-bot@kernel.org]

> get_ether_addr() parses a MAC address string with a fixed six-iteration
> loop, unconditionally calling hex_to_bin() twice per iteration.  It never
> checks for the terminating NUL, so a short string supplied through the
> configfs dev_addr attribute (e.g. "ab") makes the parser read past the
> end of the buffer, triggering a slab-out-of-bounds read reported by
> KASAN.  hex_to_bin() also returns -1 for non-hex characters, which is
> shifted and OR'ed into dev_addr.
> 
> Bail out as soon as the string ends or a non-hex digit is found, routing
> all failure paths through the existing eth_random_addr() fallback so that
> dev_addr is always fully initialized before the function returns.
> 
> Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
> Cc: stable@vger.kernel.org
> Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023110113.2969708-1-liuc63@xiaopeng.com?part=1