[PATCH] usb: gadget: configfs: zero-terminate Unicode property data

[PATCH] usb: gadget: configfs: zero-terminate Unicode property data

[Aldo Ariel Panzardo]

Unicode extended properties account for a trailing UTF-16 NUL in
data_len.  The show and descriptor paths consequently consume one more
source byte than ext_prop_data_store() allocates, exposing the byte
immediately after the allocation.

Allocate an additional zeroed byte for the source string.  This preserves
the descriptor length, supplies the terminator expected by both consumers,
and prevents the one-byte out-of-bounds read.

Fixes: 7419485f197c ("usb: gadget: configfs: OS Extended Properties descriptors support")
Reported-by: Bingquan Chen <patzilla007@gmail.com>
Link: https://lore.kernel.org/all/20260421141010.5607-1-patzilla007@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 drivers/usb/gadget/configfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 183a25f65a..2041b97ffd 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1351,9 +1351,10 @@ static ssize_t ext_prop_data_store(struct config_item *item,
 
 	if (page[len - 1] == '\n' || page[len - 1] == '\0')
 		--len;
-	new_data = kmemdup(page, len, GFP_KERNEL);
+	new_data = kzalloc(len + 1, GFP_KERNEL);
 	if (!new_data)
 		return -ENOMEM;
+	memcpy(new_data, page, len);
 
 	if (desc->opts_mutex)
 		mutex_lock(desc->opts_mutex);
-- 
2.43.0