From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5AB6928000F for ; Mon, 29 Jun 2026 19:50:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782762615; cv=none; b=sFFtCI7x/VSZ6WysPovH7bHmkJ1Rt/zpcOtzo/jgs4KJNoxs5qYUqgPJvt0dEfNJqQOEdEHFJvWKzY+TZJAJuydaUixkE92cMO4mm/XTab9LMmIh4733LkPeVs/DgBJ9gZ+1emiu8EQV+LbPO1MLjGchEOAgIHPPJEwqhcMM8lY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782762615; c=relaxed/simple; bh=qoN6igkrWbOlb45qlTXOirSohErKuB2rWvqGvlLdHWo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Y5NLir70sMta8iDSz3kidCbSocIzKe++VEA0CwpP+qfztR7Ng+em+/wbHXZUTeUuHQ/IldSXxJAnYHx1HWegKbfoSvWQXh6uMQ2XpBwDohE27QfSYhRId8Zoi0hKXV5Kt+/mZme+w4LgifkcCCS2PqdDKoWHzh9E9GpKM+kKD94= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IAZX6oVD; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IAZX6oVD" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2c82538b6b0so25611475ad.1 for ; Mon, 29 Jun 2026 12:50:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782762612; x=1783367412; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=QBn6VbDoCaQPNtGeLIJZzo8oFouBg5xwQihuCt036fc=; b=IAZX6oVDe7VOWn9QIsF+DWU0xaauLKJ4RUoR1JtLsy+Q5UEQ29Z5d715bfs0J+TbIG dANA8vQ1oxnZuyUYd2G/xCU4ujjKsxG2jxWj0RXhxmSSnqTVO8XIcqUADXRu4vYP7MwZ RdOqwAboUwSue+Dod8Vi0dOFRFjEaWUfmdWftsTUKtv39i8OP6DnAU0JFV/zaEvozl50 wXxT6WzNGiEKD/EU3y/uCUL9Me9mvNS0QaXz9psnrZ5cfq1Nhh9lMROxQKVru6bi6u7X 9wVlfEne9asBR7bZqPlcGGIYBocZzxCmRQ5jipUxhQbgL8NtNtG3hDGdofW5PlUhnb2Z TLwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782762612; x=1783367412; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=QBn6VbDoCaQPNtGeLIJZzo8oFouBg5xwQihuCt036fc=; b=UfX+rLeU7dXrrNyFLrdNGAynb48SEC2HVt5iixLed0Edg4K3t5MVbM8my+BhQL+a93 YfOst1lp4ayuxIY2ftjHYsLLUeSEVr4xzbL3Pye+DrGE1x4ukra9mWpHkcm8S+uD0oc4 09AQGJg5eYr7uuZlVI/GzayH8/4OHhEtNr2EQ+18O36YojXafEwqG9PQDO3jWZg2CDjr WZY12fQjXDezmoLtc3DwWihF7xJaXRAJ79OOge+mlgR4ZFenyrjYU1mBwvQE88xI5YEZ JifAG54nrxh1RXNoOkCmy/AMUxUv7T9EX+a3++uJIlJoYviSmiLuFU3FTmAJS6c2jeYC +seg== X-Forwarded-Encrypted: i=1; AHgh+Rr1guQM7TE9bAeKwv/GvRMFqnemHQ/LRjBQ87LYSeN5SS05fCGLHx77Sxd2gAx9D9A1mnoXxxryUPYs0Ho=@vger.kernel.org X-Gm-Message-State: AOJu0Yz18wE7FaW0zpJR+mMVzKac1+55x1iLdvTMVd/BArIYCn3t5NFB IOXTcPQA9e+DCRo2ihVOC9LFy5NKUXzsouTIlKqcmrjz/MWrBUOI6enp X-Gm-Gg: AfdE7cmIjGaS7nLzCZS3z+IViCFMzLSSOA3mKtVFMq3uF1nn2SCk8Gn688B+T75legy MAsUd+K6na19ZToipyYJtWL2wZlbyClQJwgdhI6G26Lew4uJJGOFEM6Q8fzHcjqIdxLxSjaXgHx 1VFYxXN4wgDztCf635dgswlHxayoRGOwL3xCG/Jfabj0iTSJqCXKpdaiEmOhk/ark3w7TlUOh4E bpebQAEDEBPSTn4qhVMR0BjeqS5T+ItC9xtVjAeABRH5sKyz8cSeAaXIG3mzKXJmrz7Ag2yGt9X yf82ApS4cvNnRSRS8oa/n3P6KOKJqzuKo8bIDgZTl87dqoV3Ho/tQXh8evXOZSXco11hyCW+Ekz n8KpC4gzsc1+bHGGiDJhUjhHBQhlQ1Ky33TP6nORBD0KKPi8/bbiNglqD5Xaq9MXO2dHAd89f59 n0H/zRGP1H5cN1YPDRe0brIJZALK99zCE2qvtx1qiKOR1GGSfevD4D+39d3AGcoRsC644en1s= X-Received: by 2002:a17:902:cf01:b0:2ca:202c:644e with SMTP id d9443c01a7336-2ca2e91640emr4921755ad.32.1782762612541; Mon, 29 Jun 2026 12:50:12 -0700 (PDT) Received: from node ([149.40.62.32]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c9e28d8129sm36969575ad.80.2026.06.29.12.50.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 29 Jun 2026 12:50:12 -0700 (PDT) From: Muhammad Bilal To: Greg Kroah-Hartman , Laurent Pinchart Cc: Hans Verkuil , Kees Cook , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer Date: Tue, 30 Jun 2026 00:50:04 +0500 Message-ID: <20260629195004.148405-1-meatuni001@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data: req->length = min_t(unsigned int, uvc->event_length, data->length); ... memcpy(req->buf, data->data, req->length); req->length is clamped to uvc->event_length, which is taken from the host control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to data->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->event_length and data->length both greater than 60 makes memcpy() read past the end of data->data. Clamp req->length to sizeof(data->data) as well. Fixes: a5eaaa1f33e7 ("usb: gadget: uvc: use capped length value") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal --- drivers/usb/gadget/function/uvc_v4l2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/gadget/function/uvc_v4l2.c b/drivers/usb/gadget/function/uvc_v4l2.c index 514e5930b9ca9..dfa0521a243ac 100644 --- a/drivers/usb/gadget/function/uvc_v4l2.c +++ b/drivers/usb/gadget/function/uvc_v4l2.c @@ -200,6 +200,8 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data) return usb_ep_set_halt(cdev->gadget->ep0); req->length = min_t(unsigned int, uvc->event_length, data->length); + if (req->length > sizeof(data->data)) + req->length = sizeof(data->data); req->zero = data->length < uvc->event_length; memcpy(req->buf, data->data, req->length); -- 2.54.0