virtio_gpio_get_names() walks the line names that the device returns in a block of gpio_names_size bytes, which the driver ends with a NUL, and checks each name only after stepping past it. If the block holds fewer than ngpio names, the walk reaches the end of the block after the last name, and the next iteration starts strlen() at the byte after the allocation. With a block that holds one name for four lines, KASAN reports: BUG: KASAN: slab-out-of-bounds in strlen+0x57/0x70 Read of size 1 at addr ffff8880026687c0 by task swapper/0/1 Call Trace: strlen+0x57/0x70 virtio_gpio_probe+0xcb4/0xfc0 virtio_dev_probe+0xa7a/0xc50 Allocated by task 1: devm_kmalloc+0x6e/0x280 virtio_gpio_probe+0xc06/0xfc0 The buggy address is located 0 bytes to the right of allocated 64-byte region [ffff888002668780, ffff8880026687c0) Check that a name starts inside the block before reading it. This patch is assisted by Claude Opus 5.5. Fixes: 3a29355a22c0 ("gpio: Add virtio-gpio driver") Cc: stable@vger.kernel.org Signed-off-by: Lianjie Wang --- drivers/gpio/gpio-virtio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpio/gpio-virtio.c b/drivers/gpio/gpio-virtio.c index ed6e0e90fa8aa..32326d91f33d6 100644 --- a/drivers/gpio/gpio-virtio.c +++ b/drivers/gpio/gpio-virtio.c @@ -520,13 +520,13 @@ static const char **virtio_gpio_get_names(struct virtio_gpio *vgpio, gpio_names[gpio_names_size - 1] = '\0'; for (i = 0, str = gpio_names; i < ngpio; i++) { - names[i] = str; - str += strlen(str) + 1; /* zero-length strings are allowed */ - - if (str > gpio_names + gpio_names_size) { + if (str >= gpio_names + gpio_names_size) { dev_err(dev, "gpio_names block is too short (%d)\n", i); return NULL; } + + names[i] = str; + str += strlen(str) + 1; /* zero-length strings are allowed */ } return names; base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4 -- 2.56.0