On Tue, Sep 01, 2026 at 11:30:16PM -0400, Adriano Cordova wrote:
The incoming message size from the device header (header.size) is trusted without checking that it is at least the size of the message header itself, but a value smaller than sizeof(struct gb_operation_msg_hdr) underflows request_size in gb_operation_create_incoming(), wraps around in gb_operation_message_alloc(), and results in a tiny buffer that is then written past its end in gb_operation_message_init().
Reject undersized messages before parsing the message header.
Fixes: d37b1db13f8b ("greybus: refactor gb_connection_recv()")
This isn't the commit that introduced the issue (even if that commit made things worse by removing a WARN_ON()).
Reported-by: syzbot+2fd6aefc361af86911d5@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=2fd6aefc361af86911d5 Cc: stable@vger.kernel.org
How did you find and fix this issue? Are you missing an Assisted-by tag here?
Signed-off-by: Adriano Cordova adrianox@gmail.com
Note that this is also being fixed here:
https://lore.kernel.org/lkml/tencent_1CB189506DEFA4B38099D654FE6C2A2F2E07@qq...
Johan