[PATCH 0/4] usb: initialize debugfs command buffers

Jiale Yao yaojiale02 at 163.com
Wed Oct 21 03:47:15 PDT 2026


Several USB debugfs write handlers copy user input into uninitialized stack
buffers and then compare fixed command lengths. A short write that matches a
command prefix can therefore make strncmp() inspect uninitialized bytes.

Zero-initialize the affected command buffers so every copied input is
terminated and the comparisons do not depend on stale stack contents.

Jiale Yao (4):
  usb: dwc2: initialize debugfs command buffer
  usb: gadget: renesas_usb3: initialize debugfs command buffer
  xhci: debugfs: initialize command buffer
  usb: mtu3: initialize debugfs command buffer

 drivers/usb/dwc2/debugfs.c            | 2 +-
 drivers/usb/gadget/udc/renesas_usb3.c | 2 +-
 drivers/usb/host/xhci-debugfs.c       | 2 +-
 drivers/usb/mtu3/mtu3_debugfs.c       | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

-- 
2.34.1




More information about the Linux-mediatek mailing list