Commit 30141687 authored by Xinyu Liu's avatar Xinyu Liu Committed by Greg Kroah-Hartman
Browse files

usb: gadget: configfs: Fix OOB read on empty string write 



When writing an empty string to either 'qw_sign' or 'landingPage'
sysfs attributes, the store functions attempt to access page[l - 1]
before validating that the length 'l' is greater than zero.

This patch fixes the vulnerability by adding a check at the beginning
of os_desc_qw_sign_store() and webusb_landingPage_store() to handle
the zero-length input case gracefully by returning immediately.

Signed-off-by: default avatarXinyu Liu <katieeliu@tencent.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/tencent_B1C9481688D0E95E7362AB2E999DE8048207@qq.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 67a59f82

drivers/usb/gadget/configfs.c

+4 −0
Original line number Diff line number Diff line
@@ -1065,6 +1065,8 @@ static ssize_t webusb_landingPage_store(struct config_item *item, const char *pa 
	unsigned int bytes_to_strip = 0;

	int l = len;



	if (!len)

		return len;

	if (page[l - 1] == '\n') {

		--l;

		++bytes_to_strip;
@@ -1188,6 +1190,8 @@ static ssize_t os_desc_qw_sign_store(struct config_item *item, const char *page, 
	struct gadget_info *gi = os_desc_item_to_gadget_info(item);

	int res, l;



	if (!len)

		return len;

	l = min_t(int, len, OS_STRING_QW_SIGN_LEN >> 1);

	if (page[l - 1] == '\n')

		--l;