Hello Greg,
On the discovery and testing: I manually reviewed the affected code and used a userspace ASan harness based on the Greybus structures to exercise the two length calculations.
The harness demonstrated the 2047-byte and 1983-byte copies into the 1600-byte and 320-byte destinations, respectively. It did not exercise a live CAP ioctl or Greybus transport and did not produce an in-kernel KASAN report.
I also built drivers/staging/greybus/authentication.o with W=1 on arm64, and the submitted patch passed checkpatch without warnings. I do not have access to real Greybus hardware, so the change has not been tested on a physical device.
And yes, I omitted the Assisted-by tag. That was my mistake. I used OpenAI Codex while analyzing, preparing, and validating the patch.
thanks,
On Fri, Sep 4, 2026 at 10:03 AM Greg KH gregkh@linuxfoundation.org wrote:
On Fri, Sep 04, 2026 at 03:46:28AM +0000, Suraj Theekshana wrote:
cap_get_ims_certificate() and cap_authenticate() derive copy lengths from response payload sizes without checking the response header size or destination capacity.
How was this found and tested?
And doesn't this info come from the hardware itself? Is it not trusted here?
Reject responses smaller than their headers with -EMSGSIZE. Reject certificate and signature data larger than their fixed ioctl buffers with -E2BIG.
Signed-off-by: Suraj Theekshana surajtheekshana1111@gmail.com
Did you forget an Assisted-by: tag?
thanks,
greg k-h