[PATCH 0/4] usb: initialize debugfs command buffers
Jiale Yao
yaojiale02 at 163.com
Wed Oct 21 03:47:15 PDT 2026
Several USB debugfs write handlers copy user input into uninitialized stack
buffers and then compare fixed command lengths. A short write that matches a
command prefix can therefore make strncmp() inspect uninitialized bytes.
Zero-initialize the affected command buffers so every copied input is
terminated and the comparisons do not depend on stale stack contents.
Jiale Yao (4):
usb: dwc2: initialize debugfs command buffer
usb: gadget: renesas_usb3: initialize debugfs command buffer
xhci: debugfs: initialize command buffer
usb: mtu3: initialize debugfs command buffer
drivers/usb/dwc2/debugfs.c | 2 +-
drivers/usb/gadget/udc/renesas_usb3.c | 2 +-
drivers/usb/host/xhci-debugfs.c | 2 +-
drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
--
2.34.1
More information about the Linux-mediatek
mailing list