From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86AF6449B23 for ; Mon, 17 Aug 2026 16:03:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786982624; cv=none; b=iepTC+F+Nx5TQ/+8NzO1SsyG/AbVn5gGKEnCAWdgh1J3370QCDCok2OXkfuHJnOkSWA/gr2fxCFj/nIGGcabwMrwuiRiDNyn1TKwD7EH/qlBQIJzEtfSDfrZHDst6T73r5VqFWkjblHNJI47R2jiiS8QTCiBP50iR1nEYyEitl4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786982624; c=relaxed/simple; bh=yguGrGipj1Sr3lM9LirwlqlAubM2+wrNpMoDM1U6p5M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=E1mKK1o5xEpxIlydTVyNjMWeaR7LnIFK+k9jxw+Gc7hDr8rWRLmZhkRfDjyBKQTm46RVMlTpg/WR1J+4sEfCAmy3bBvsHN1RPBsOd6bMxjnoyUn71OMzzuFrAZqPi6EfMyIvKLNJbz+4bEXl/+pn+KnXUANdPDWiLs5VFBsYWac= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oRVXyAfh; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oRVXyAfh" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-38de840f2f0so3004185a91.0 for ; Mon, 17 Aug 2026 09:03:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786982616; x=1787587416; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=7eAUOGoRQ+1j0VLJyMKulBFqB6sfqwvkZHzDAzcL4Sc=; b=oRVXyAfhw1YQ1MN0B0HFJVplEVhCpIMepbJ9TURT97sFPPU0nd065c/WbFCTkzTzeR LlUzq0+pY4aFExfYmYJe9I+GimIKv5GSb8ob+PvynKYPk0tubP5eq76AOTP18jqHb0m1 WardKUGGlq+F8oEDUcSkgjGDsnvZo7XNw+D2+sT8xGAH7KXRRUk89jGBak2h9tOXr9cy OYqKKrwKRgBhOxMhBq2WGmYAueznuv58uIEJJukyd7VmSrwHhxaQ55J9ZH18Fl7taEU3 Vai0YpMPvWaG8PgOMnme36JssS21ul9vIP8RXadPT4X14QGXEpnc+mRO5D94Sn0gp5ov L0eA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786982616; x=1787587416; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=7eAUOGoRQ+1j0VLJyMKulBFqB6sfqwvkZHzDAzcL4Sc=; b=JVIKzw/hpo0AwjykEazF38l2oLMvStoe8SCZw5Y5lwpdA4xmRa6cCAeWNHkYg0xaPg zwcrfbt63hkQEwA2qh7Uc8w7ejB2dtIE7oQzHmrAC1RaU21v4uMWkaFUjvgZy5IEPuAz vmERcKkd4lRhzPD1hy2IP54W0N2ssr5XkTjDT0Gj6vSvA+tq16vbXEG1uzpgSsocAs9B BUL6IgVkGHKsfQNpoi/9hVe0pmvEi4j/LSn3H6CDsz4fgmkxjmOucQ8IudsAwEmAF5Iq IduEA+y4bSireOnNbVuZqfrUedEUznZ5luPG3jgebVGxWWJ80XEfdCGRT1A0sVW6qb1Q nBQQ== X-Forwarded-Encrypted: i=1; AHgh+RpJbjA/MgDLU05DU6A6DpqUtNF3EIes5GFyD4XXazxzy/2RdrTytIl5z3Ve8TUjcO2lE17/O4n0wTB+GgA=@vger.kernel.org X-Gm-Message-State: AOJu0YzaZM83A17tpSlrrlZ65pBDlRdOTEifQjCqd0brtyETull6U+yX ZMcARdQhK54B0XHgK72e1PNQdoPZO/XWnDDka+h3TJKeQXVgjWOI4ct5 X-Gm-Gg: AR+sD12cjbVODr1fTOONJBo3BJ1kpKJtaT+1aU74kC42uDnbi3NxNkRlYl/Cztp0M5i Z1NPdjTlUjeHja3KhyDeIfz6Lv1N4IH6ZgjZOWtpa/L3bpO0GakM21q60xvn8D/aHxDUJBPG/5q lVjnkglteiycOFrAVh6a7Y4I25q5pFEKs8Fp+9RWQWaI7EUXUrwb5pP8bG9PaJJc4kMaWXRXe0y P48nLtskuAWyFAs8fLxLjwAmoAullIHcJDDg2v0y3010AjgnJbKdQU+v/dXdR3HEEEsMpLMzcWZ BB+LgG64Nq59fI6hUuEg1nUeXlcYjlf5E37uUVzGyh4V6xW91rsMePQezuuZQQfGdSFhlcfe1s9 mIX9fhejqKCSbr52eRLoYz7XA4Hx3Jem/xbsfsTno0UxH49fXJqZ3lYUFzr6f/Qs2LJKvbOyKCT OA448ya7xqPMHynJ8+Ke4SlDmdu2LTr00j7V67A63/q0kWVrOMzSCM91Eomtw9pTACkoHChAe57 onk X-Received: by 2002:a17:90b:528a:b0:38e:5ac1:9517 with SMTP id 98e67ed59e1d1-3933b7c3696mr26862150a91.3.1786982616335; Mon, 17 Aug 2026 09:03:36 -0700 (PDT) Received: from Default ([2409:40f4:103f:ca54:3a70:ebd6:25c9:29fd]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39531e31a9dsm5481969a91.4.2026.08.17.09.03.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Aug 2026 09:03:35 -0700 (PDT) From: Jeffin Philip To: stern@rowland.harvard.edu Cc: christophe.jaillet@wanadoo.fr, felipe.balbi@linux.intel.com, gregkh@linuxfoundation.org, jeffinphilip14@gmail.com, kees@kernel.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, stable@vger.kernel.org, syzbot+791be35f1fbcc85d06d7@syzkaller.appspotmail.com Subject: [PATCH] usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() Date: Mon, 17 Aug 2026 21:33:19 +0530 Message-ID: <20260817160319.28251-1-jeffinphilip14@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Mon, 17 Aug 2026 10:01:36 -0400, Alan Stern wrote: >In fe5a6c48fd95 ("usb: gadget: storage: get rid of >fsg_num_buffers_validate()"), the code that was changed originally >required the number to lie between 2 and 32. Even 1 was not acceptable. Kconfig currently sets the limit from 2 to 256 with default as 2. However, we use that only at build time. So, if we enter during runtime via configfs, we set page content to 0\0 and get the null pointer dereference. So we will need to add the check for num < 2 in fsg_opts_num_buffers_store() and return EINVAL? Upper bound is 256 which is below what kstrtou8() can return anyway. Thanks, Jeffin.