[PATCH 0/4] usb: initialize debugfs command buffers

[PATCH 0/4] usb: initialize debugfs command buffers

[Jiale Yao]

Several USB debugfs write handlers copy user input into uninitialized stack
buffers and then compare fixed command lengths. A short write that matches a
command prefix can therefore make strncmp() inspect uninitialized bytes.

Zero-initialize the affected command buffers so every copied input is
terminated and the comparisons do not depend on stale stack contents.

Jiale Yao (4):
  usb: dwc2: initialize debugfs command buffer
  usb: gadget: renesas_usb3: initialize debugfs command buffer
  xhci: debugfs: initialize command buffer
  usb: mtu3: initialize debugfs command buffer

 drivers/usb/dwc2/debugfs.c            | 2 +-
 drivers/usb/gadget/udc/renesas_usb3.c | 2 +-
 drivers/usb/host/xhci-debugfs.c       | 2 +-
 drivers/usb/mtu3/mtu3_debugfs.c       | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

-- 
2.34.1

[PATCH 1/4] usb: dwc2: initialize debugfs command buffer

[Jiale Yao]

testmode_write() copies user input into an uninitialized stack buffer
and compares fixed command lengths. A short write matching a command
prefix can make strncmp() inspect bytes that were not initialized.

Zero-initialize the buffer so the copied input is always terminated.

Fixes: f91eea447ac3 ("usb: dwc2: move debugfs code to a separate file")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/usb/dwc2/debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/debugfs.c b/drivers/usb/dwc2/debugfs.c
index 3116ac72747f..9fedeb2e3562 100644
--- a/drivers/usb/dwc2/debugfs.c
+++ b/drivers/usb/dwc2/debugfs.c
@@ -31,7 +31,7 @@ static ssize_t testmode_write(struct file *file, const char __user *ubuf, size_t
 	struct dwc2_hsotg	*hsotg = s->private;
 	unsigned long		flags;
 	u32			testmode = 0;
-	char			buf[32];
+	char			buf[32] = { };
 
 	if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
 		return -EFAULT;
-- 
2.34.1

[PATCH 2/4] usb: gadget: renesas_usb3: initialize debugfs command buffer

[Jiale Yao]

renesas_usb3_b_device_write() copies user input into an uninitialized
stack buffer before comparing it as a command. A zero-length write makes
strncmp() inspect an uninitialized byte.

Zero-initialize the buffer so the copied input is always terminated.

Fixes: 43ba968b00ea ("usb: gadget: udc: renesas_usb3: add debugfs to set the b-device mode")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/usb/gadget/udc/renesas_usb3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 2c9c3e935a5e..baa654f616f7 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -2613,7 +2613,7 @@ static ssize_t renesas_usb3_b_device_write(struct file *file,
 {
 	struct seq_file *s = file->private_data;
 	struct renesas_usb3 *usb3 = s->private;
-	char buf[32];
+	char buf[32] = { };
 
 	if (!usb3->driver)
 		return -ENODEV;
-- 
2.34.1

[PATCH 3/4] xhci: debugfs: initialize command buffer

[Jiale Yao]

xhci_port_write() copies user input into an uninitialized stack buffer
and compares ten bytes against the compliance command. A short matching
prefix can make strncmp() inspect bytes that were not initialized.

Zero-initialize the buffer so the copied input is always terminated.

Fixes: 87a03802184c ("xhci: debugfs: add debugfs interface to enable compliance mode for a port")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/usb/host/xhci-debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index 2aa01d99f23d..a020cbab9674 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -347,7 +347,7 @@ static ssize_t xhci_port_write(struct file *file,  const char __user *ubuf,
 	struct seq_file         *s = file->private_data;
 	struct xhci_port	*port = s->private;
 	struct xhci_hcd		*xhci = hcd_to_xhci(port->rhub->hcd);
-	char                    buf[32];
+	char                    buf[32] = { };
 	u32			portsc;
 	unsigned long		flags;
 
-- 
2.34.1

Re: [PATCH 3/4] xhci: debugfs: initialize command buffer

[Mathias Nyman]

On 10/21/26 13:47, Jiale Yao wrote:
> xhci_port_write() copies user input into an uninitialized stack buffer
> and compares ten bytes against the compliance command. A short matching
> prefix can make strncmp() inspect bytes that were not initialized.
> 
> Zero-initialize the buffer so the copied input is always terminated.
> 
> Fixes: 87a03802184c ("xhci: debugfs: add debugfs interface to enable compliance mode for a port")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>   drivers/usb/host/xhci-debugfs.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
> index 2aa01d99f23d..a020cbab9674 100644
> --- a/drivers/usb/host/xhci-debugfs.c
> +++ b/drivers/usb/host/xhci-debugfs.c
> @@ -347,7 +347,7 @@ static ssize_t xhci_port_write(struct file *file,  const char __user *ubuf,
>   	struct seq_file         *s = file->private_data;
>   	struct xhci_port	*port = s->private;
>   	struct xhci_hcd		*xhci = hcd_to_xhci(port->rhub->hcd);
> -	char                    buf[32];
> +	char                    buf[32] = { };
>   	u32			portsc;
>   	unsigned long		flags;
>   

Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>

I'll cherry pick this in case Greg doesn't take the whole series

Thanks
Mathias

[PATCH 4/4] usb: mtu3: initialize debugfs command buffer

[Jiale Yao]

ssusb_mode_write() copies user input into an uninitialized stack buffer
and compares fixed command lengths. A short write matching a command
prefix can make strncmp() inspect bytes that were not initialized.

Zero-initialize the buffer so the copied input is always terminated.

Fixes: 4aab6ad24a10 ("usb: mtu3: move vbus and mode debugfs interfaces into mtu3_debugfs.c")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
index c003049bafbf..8976dbfaa585 100644
--- a/drivers/usb/mtu3/mtu3_debugfs.c
+++ b/drivers/usb/mtu3/mtu3_debugfs.c
@@ -423,7 +423,7 @@ static ssize_t ssusb_mode_write(struct file *file, const char __user *ubuf,
 {
 	struct seq_file *sf = file->private_data;
 	struct ssusb_mtk *ssusb = sf->private;
-	char buf[16];
+	char buf[16] = { };
 
 	if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
 		return -EFAULT;
-- 
2.34.1