kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Xinyu Liu 783ea37b23 usb: gadget: configfs: Fix OOB read on empty string write 
commit 3014168731 upstream.

When writing an empty string to either 'qw_sign' or 'landingPage'
sysfs attributes, the store functions attempt to access page[l - 1]
before validating that the length 'l' is greater than zero.

This patch fixes the vulnerability by adding a check at the beginning
of os_desc_qw_sign_store() and webusb_landingPage_store() to handle
the zero-length input case gracefully by returning immediately.

Signed-off-by: Xinyu Liu <katieeliu@tencent.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/tencent_B1C9481688D0E95E7362AB2E999DE8048207@qq.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-07-24 08:56:20 +02:00
..
function Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" 2025-07-17 18:37:12 +02:00
legacy move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
udc USB: gadget: udc: fix const issue in gadget_match_driver() 2025-06-19 15:32:13 +02:00
composite.c usb: gadget: Use get_status callback to set remote wakeup capability 2025-05-18 08:24:55 +02:00
config.c usb: gadget: config: remove max speed check in usb_assign_descriptors() 2023-08-22 14:48:33 +02:00
configfs.c usb: gadget: configfs: Fix OOB read on empty string write 2025-07-24 08:56:20 +02:00
configfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
epautoconf.c usb: gadget: fix for a typo that conveys logically-inverted information. 2021-09-14 10:27:54 +02:00
functions.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
Kconfig usb: gadget: midi2: Reverse-select at the right place 2025-01-17 13:40:54 +01:00
Makefile usb: gadget: Makefile: remove ccflags-y 2022-03-18 12:56:08 +01:00
u_f.c usb: gadget: function: move u_f.h to include/linux/usb/func_utils.h 2024-09-03 09:57:08 +02:00
u_os_desc.h move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
usbstring.c usb: gadget: fix langid kernel-doc warning in usbstring.c 2020-07-09 10:13:07 +03:00