[PATCH] net/9p/usbg: fix prefix matching in device lookup

[PATCH] net/9p/usbg: fix prefix matching in device lookup

[Yizhou Zhao]

p9_usbg_create() matches the mount source against registered usb9pfs
instance tags with strncmp() and the length of the caller supplied source.
That accepts any prefix of the registered tag.

For example, a gadget instance tagged "secret_channel" can be selected with
"s", "sec", or any other non-empty prefix.  Once selected, the instance is
marked in use and the client is attached to that transport.  This differs
from the configfs tag lookup path, which uses strcmp() and therefore
requires an exact tag match.

Require an exact tag match in p9_usbg_create() as well.

Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: GLM:GLM-5.1
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
---
 net/9p/trans_usbg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c
index 1ce70338999c..8c66795f2853 100644
--- a/net/9p/trans_usbg.c
+++ b/net/9p/trans_usbg.c
@@ -391,7 +391,7 @@ static int p9_usbg_create(struct p9_client *client, struct fs_context *fc)
 	guard(mutex)(&usb9pfs_lock);
 
 	list_for_each_entry(dev, &usbg_instance_list, usb9pfs_instance) {
-		if (!strncmp(devname, dev->tag, strlen(devname))) {
+		if (!strcmp(devname, dev->tag)) {
 			if (!dev->inuse) {
 				dev->inuse = true;
 				found = 1;
-- 
2.43.0

Re: [PATCH] net/9p/usbg: fix prefix matching in device lookup

[Dominique Martinet]

Yizhou Zhao wrote on Sun, Jun 07, 2026 at 08:19:04PM +0800:
> p9_usbg_create() matches the mount source against registered usb9pfs
> instance tags with strncmp() and the length of the caller supplied source.
> That accepts any prefix of the registered tag.
> 
> For example, a gadget instance tagged "secret_channel" can be selected with
> "s", "sec", or any other non-empty prefix.  Once selected, the instance is
> marked in use and the client is attached to that transport.  This differs
> from the configfs tag lookup path, which uses strcmp() and therefore
> requires an exact tag match.
> 
> Require an exact tag match in p9_usbg_create() as well.
> 
> Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
> Cc: stable@vger.kernel.org
> Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
> Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
> Reported-by: Ao Wang <wangao@seu.edu.cn>
> Reported-by: Xuewei Feng <fengxw06@126.com>
> Reported-by: Qi Li <qli01@tsinghua.edu.cn>
> Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
> Assisted-by: GLM:GLM-5.1
> Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>

Thanks, there was another identical patch later so I did the same
(actually just adding co-authored-by, I kept the commit message the
same)

I'm honestly not sure what to do in these case but there's probably no
harm in overcrediting...

https://lore.kernel.org/r/20260719040346.88295-1-liu.yun@linux.dev
https://github.com/martinetd/linux/commit/9ee83ef8d24f11feb55fd0d222c0ec19f09dbd3f

-- 
Dominique

[PATCH] net/9p/usbg: fix prefix matching in device lookup

[Yizhou Zhao]

 	list_for_each_entry(dev, &usbg_instance_list, usb9pfs_instance) {
-		if (!strncmp(devname, dev->tag, strlen(devname))) {
+		if (!strcmp(devname, dev->tag)) {
 			if (!dev->inuse) {
 				dev->inuse = true;
 				found = 1;
-- 
2.43.0