The GET_DEVICE_ID request handler in printer_func_setup() copies the configfs-provided pnp_string into the EP0 request buffer. The pnp_string length is bounded by the configfs page size, but is not limited by the size of the EP0 buffer. Since the first two bytes of the buffer are used for the length field, a pnp_string longer than USB_COMP_EP0_BUFSIZ - 2 causes memcpy() to write beyond the end of the EP0 buffer. Limit the copied string length to USB_COMP_EP0_BUFSIZ - 2, ensuring that both the length field and the string fit within the EP0 buffer. Fixes: 24b7ba2f88e0 ("usb: gadget: function: fix dangling pnp_string in f_printer.c") Cc: stable@vger.kernel.org Reviewed-by: Weibin Liu Signed-off-by: Fang Xieyan --- drivers/usb/gadget/function/f_printer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c index d295ade8f..17ccce78d 100644 --- a/drivers/usb/gadget/function/f_printer.c +++ b/drivers/usb/gadget/function/f_printer.c @@ -1022,7 +1022,8 @@ static int printer_func_setup(struct usb_function *f, value = 0; break; } - value = strlen(*dev->pnp_string); + value = min_t(int, strlen(*dev->pnp_string), + USB_COMP_EP0_BUFSIZ - 2); buf[0] = (value >> 8) & 0xFF; buf[1] = value & 0xFF; memcpy(buf + 2, *dev->pnp_string, value); -- 2.50.1