Unicode extended properties account for a trailing UTF-16 NUL in data_len. The show and descriptor paths consequently consume one more source byte than ext_prop_data_store() allocates, exposing the byte immediately after the allocation. Allocate an additional zeroed byte for the source string. This preserves the descriptor length, supplies the terminator expected by both consumers, and prevents the one-byte out-of-bounds read. Fixes: 7419485f197c ("usb: gadget: configfs: OS Extended Properties descriptors support") Reported-by: Bingquan Chen Link: https://lore.kernel.org/all/20260421141010.5607-1-patzilla007@gmail.com/ Cc: stable@vger.kernel.org Signed-off-by: Aldo Ariel Panzardo --- drivers/usb/gadget/configfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index 183a25f65a..2041b97ffd 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -1351,9 +1351,10 @@ static ssize_t ext_prop_data_store(struct config_item *item, if (page[len - 1] == '\n' || page[len - 1] == '\0') --len; - new_data = kmemdup(page, len, GFP_KERNEL); + new_data = kzalloc(len + 1, GFP_KERNEL); if (!new_data) return -ENOMEM; + memcpy(new_data, page, len); if (desc->opts_mutex) mutex_lock(desc->opts_mutex); -- 2.43.0