diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-06 17:19:35 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-17 16:14:10 +0200 |
| commit | 18b6510f642dbcb856c3af8be974d1600f3ba2d3 (patch) | |
| tree | 028eeb1bd6e520bf079d1e976426845654796fdc /drivers/greybus | |
| parent | 7d3a708af7f4e2af9e114d731bd60d30c1ec884e (diff) | |
| download | linux-next-18b6510f642dbcb856c3af8be974d1600f3ba2d3.tar.gz linux-next-18b6510f642dbcb856c3af8be974d1600f3ba2d3.zip | |
greybus: manifest: validate string descriptor header
identify_descriptor() computes a string descriptor size from
desc->string.length.
Require the descriptor to contain the fixed string descriptor header
before reading the variable string length. The existing descriptor-size
check then reports the short descriptor.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260706091935.78020-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/greybus')
| -rw-r--r-- | drivers/greybus/manifest.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/greybus/manifest.c b/drivers/greybus/manifest.c index 9be5d95da587..3b685ace2036 100644 --- a/drivers/greybus/manifest.c +++ b/drivers/greybus/manifest.c @@ -122,6 +122,8 @@ static int identify_descriptor(struct gb_interface *intf, switch (desc_header->type) { case GREYBUS_TYPE_STRING: expected_size += sizeof(struct greybus_descriptor_string); + if (desc_size < expected_size) + break; expected_size += desc->string.length; /* String descriptors are padded to 4 byte boundaries */ |