[PATCH] usb: gadget: configfs: NUL-terminate extended property data

[PATCH] usb: gadget: configfs: NUL-terminate extended property data

[Yingjie Wang]

Unicode extended properties account for a UTF-16 terminator in
ext_prop->data_len.  The configfs store path currently allocates only the
input bytes, so ext_prop_data_show() copies one byte past the allocation.

Use kmemdup_nul() for the configfs data so the source byte implied by the
terminator-inclusive length is present for both the configfs readback and
the descriptor conversion.

Fixes: 7419485f197c ("usb: gadget: configfs: OS Extended Properties descriptors support")

Reported-by: Bingquan Chen <patzilla007@gmail.com>
Link: https://lore.kernel.org/all/20260421141010.5607-1-patzilla007@gmail.com/
Cc: stable@vger.kernel.org

Tested: x86-64 KASAN configfs readback through a built-in RNDIS function
instance.  The baseline reports a slab-out-of-bounds read in
ext_prop_data_show(); the patched kernel reads back the expected 0x41 0x00
bytes with no KASAN report.

Signed-off-by: Yingjie Wang <1075151112@qq.com>
---
 drivers/usb/gadget/configfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 51df6d1d1487a..c302e8dd25a78 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1351,7 +1351,7 @@ static ssize_t ext_prop_data_store(struct config_item *item,
 
 	if (page[len - 1] == '\n' || page[len - 1] == '\0')
 		--len;
-	new_data = kmemdup(page, len, GFP_KERNEL);
+	new_data = kmemdup_nul(page, len, GFP_KERNEL);
 	if (!new_data)
 		return -ENOMEM;
 

base-commit: 6b4b543fa18757297ac756a6fe6e64f506b7844a
-- 
2.43.0

Re: [PATCH] usb: gadget: configfs: NUL-terminate extended property data

[sashiko-bot]

> Unicode extended properties account for a UTF-16 terminator in
> ext_prop->data_len.  The configfs store path currently allocates only the
> input bytes, so ext_prop_data_show() copies one byte past the allocation.
> 
> Use kmemdup_nul() for the configfs data so the source byte implied by the
> terminator-inclusive length is present for both the configfs readback and
> the descriptor conversion.
> 
> Fixes: 7419485f197c ("usb: gadget: configfs: OS Extended Properties descriptors support")
> 
> Reported-by: Bingquan Chen <patzilla007@gmail.com>
> Link: https://lore.kernel.org/all/20260421141010.5607-1-patzilla007@gmail.com/
> Cc: stable@vger.kernel.org
> 
> Tested: x86-64 KASAN configfs readback through a built-in RNDIS function
> instance.  The baseline reports a slab-out-of-bounds read in
> ext_prop_data_show(); the patched kernel reads back the expected 0x41 0x00
> bytes with no KASAN report.
> 
> Signed-off-by: Yingjie Wang <1075151112@qq.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/tencent_6FF2EBE4EF5FF4F324C8DC4AD0F39588E505@qq.com?part=1