identify_descriptor() computes a string descriptor size from desc->string.length.
Require the descriptor to contain the fixed string descriptor header before reading the variable string length. The existing descriptor-size check then reports the short descriptor.
Signed-off-by: Pengpeng Hou pengpeng@iscas.ac.cn --- drivers/greybus/manifest.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/greybus/manifest.c b/drivers/greybus/manifest.c index 9be5d95da587..3b685ace2036 100644 --- a/drivers/greybus/manifest.c +++ b/drivers/greybus/manifest.c @@ -122,6 +122,8 @@ static int identify_descriptor(struct gb_interface *intf, switch (desc_header->type) { case GREYBUS_TYPE_STRING: expected_size += sizeof(struct greybus_descriptor_string); + if (desc_size < expected_size) + break; expected_size += desc->string.length;
/* String descriptors are padded to 4 byte boundaries */
On Mon, Jul 06, 2026 at 05:19:35PM +0800, Pengpeng Hou wrote:
identify_descriptor() computes a string descriptor size from desc->string.length.
Require the descriptor to contain the fixed string descriptor header before reading the variable string length. The existing descriptor-size check then reports the short descriptor.
Signed-off-by: Pengpeng Hou pengpeng@iscas.ac.cn
drivers/greybus/manifest.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/greybus/manifest.c b/drivers/greybus/manifest.c index 9be5d95da587..3b685ace2036 100644 --- a/drivers/greybus/manifest.c +++ b/drivers/greybus/manifest.c @@ -122,6 +122,8 @@ static int identify_descriptor(struct gb_interface *intf, switch (desc_header->type) { case GREYBUS_TYPE_STRING: expected_size += sizeof(struct greybus_descriptor_string);
if (desc_size < expected_size)break;
Nice, but how was this tested? How was it found?
thanks,
greg k-h
-
Greg Kroah-Hartman -
Pengpeng Hou