On Fri, Sep 04, 2026 at 04:08:20PM +0800, Yang Zi wrote:

gb_connection_recv() accepts a received message whose advertised size is smaller than struct gb_operation_msg_hdr. In particular, a header with a size of zero passes the incomplete-message check and reaches gb_operation_create_incoming().

The subtraction used to derive the request payload size then underflows. When gb_operation_message_alloc() adds the header size, the result wraps to zero, bypassing the maximum-buffer-size check. kzalloc(0) returns ZERO_SIZE_PTR and gb_operation_message_init() subsequently dereferences it.

Reject advertised sizes smaller than the message header. Also check the payload size before adding the header size, so that the size calculation cannot wrap and bypass the buffer-size limit.

This issue was found using a locally modified syzkaller. The analysis and fix were assisted by GPT-5.6.

Fixes: d90c25b0a279 ("greybus: let operation layer examine incoming data")

This one should also be backported:

Cc: stable@vger.kernel.org

Assisted-by: Codex:gpt-5.6 Signed-off-by: Yang Zi 2959243019@qq.com

---

You should put a short change log here (after ---) when revising patches.

No need to resend this time, but keep in mind for the future.

Reviewed-by: Johan Hovold johan@kernel.org

Johan