Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:09:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

greybus: manifest: validate string descriptor header

Browse Source 
identify_descriptor() computes a string descriptor size from
desc->string.length.

Require the descriptor to contain the fixed string descriptor header
before reading the variable string length. The existing descriptor-size
check then reports the short descriptor.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260706091935.78020-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Pengpeng Hou
2026-07-17 16:14:10 +02:00
committed by Greg Kroah-Hartman
parent 7d3a708af7
commit 18b6510f64
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/greybus/manifest.c
+2
View File
@@ -122,6 +122,8 @@ static int identify_descriptor(struct gb_interface *intf,
switch (desc_header->type) {
case GREYBUS_TYPE_STRING:
expected_size += sizeof(struct greybus_descriptor_string);
if (desc_size < expected_size)
break;
expected_size += desc->string.length;
/* String descriptors are padded to 4 byte boundaries */