[PATCH] usb: gadget: u_ether: fix out-of-bounds read in get_ether_addr

[PATCH] usb: gadget: u_ether: fix out-of-bounds read in get_ether_addr

[liuc63]

get_ether_addr() parses a MAC address string with a fixed six-iteration
loop, unconditionally calling hex_to_bin() twice per iteration.  It never
checks for the terminating NUL, so a short string supplied through the
configfs dev_addr attribute (e.g. "ab") makes the parser read past the
end of the buffer, triggering a slab-out-of-bounds read reported by
KASAN.  hex_to_bin() also returns -1 for non-hex characters, which is
shifted and OR'ed into dev_addr.

Bail out as soon as the string ends or a non-hex digit is found, routing
all failure paths through the existing eth_random_addr() fallback so that
dev_addr is always fully initialized before the function returns.

Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
Cc: stable@vger.kernel.org
Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/function/u_ether.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 59d85d6a84a8..12edad59ddc3 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -689,17 +689,26 @@ static int get_ether_addr(const char *str, u8 *dev_addr)
 		unsigned	i;
 
 		for (i = 0; i < 6; i++) {
-			unsigned char num;
+			int hi, lo;
 
+			if (!*str)
+				goto fail;
 			if ((*str == '.') || (*str == ':'))
 				str++;
-			num = hex_to_bin(*str++) << 4;
-			num |= hex_to_bin(*str++);
-			dev_addr [i] = num;
+			if (!*str)
+				goto fail;
+			hi = hex_to_bin(*str++);
+			if (hi < 0 || !*str)
+				goto fail;
+			lo = hex_to_bin(*str++);
+			if (lo < 0)
+				goto fail;
+			dev_addr[i] = (hi << 4) | lo;
 		}
 		if (is_valid_ether_addr(dev_addr))
 			return 0;
 	}
+fail:
 	eth_random_addr(dev_addr);
 	return 1;
 }
-- 
2.50.1