)]}'
{
  "commit": "d126cf46f829d146dde3e6a8963e095ac6cfcd1c",
  "tree": "42876fc8e2acca85985f1e831d3c73616bdd9ae2",
  "parents": [
    "303c5366d664e0b860041e0647952dafcd71c5a1"
  ],
  "author": {
    "name": "Kyungtae Kim",
    "email": "kt0755@gmail.com",
    "time": "Sun May 10 05:43:34 2020 +0000"
  },
  "committer": {
    "name": "Ben Hutchings",
    "email": "ben@decadent.org.uk",
    "time": "Thu Jun 11 19:05:53 2020 +0100"
  },
  "message": "USB: gadget: fix illegal array access in binding with UDC\n\ncommit 15753588bcd4bbffae1cca33c8ced5722477fe1f upstream.\n\nFuzzUSB (a variant of syzkaller) found an illegal array access\nusing an incorrect index while binding a gadget with UDC.\n\nReference: https://www.spinics.net/lists/linux-usb/msg194331.html\n\nThis bug occurs when a size variable used for a buffer\nis misused to access its strcpy-ed buffer.\nGiven a buffer along with its size variable (taken from user input),\nfrom which, a new buffer is created using kstrdup().\nDue to the original buffer containing 0 value in the middle,\nthe size of the kstrdup-ed buffer becomes smaller than that of the original.\nSo accessing the kstrdup-ed buffer with the same size variable\ntriggers memory access violation.\n\nThe fix makes sure no zero value in the buffer,\nby comparing the strlen() of the orignal buffer with the size variable,\nso that the access to the kstrdup-ed buffer is safe.\n\nBUG: KASAN: slab-out-of-bounds in gadget_dev_desc_UDC_store+0x1ba/0x200\ndrivers/usb/gadget/configfs.c:266\nRead of size 1 at addr ffff88806a55dd7e by task syz-executor.0/17208\n\nCPU: 2 PID: 17208 Comm: syz-executor.0 Not tainted 5.6.8 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0xce/0x128 lib/dump_stack.c:118\n print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374\n __kasan_report+0x131/0x1b0 mm/kasan/report.c:506\n kasan_report+0x12/0x20 mm/kasan/common.c:641\n __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132\n gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266\n flush_write_buffer fs/configfs/file.c:251 [inline]\n configfs_write_file+0x2f1/0x4c0 fs/configfs/file.c:283\n __vfs_write+0x85/0x110 fs/read_write.c:494\n vfs_write+0x1cd/0x510 fs/read_write.c:558\n ksys_write+0x18a/0x220 fs/read_write.c:611\n __do_sys_write fs/read_write.c:623 [inline]\n __se_sys_write fs/read_write.c:620 [inline]\n __x64_sys_write+0x73/0xb0 fs/read_write.c:620\n do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nSigned-off-by: Kyungtae Kim \u003ckt0755@gmail.com\u003e\nReported-and-tested-by: Kyungtae Kim \u003ckt0755@gmail.com\u003e\nCc: Felipe Balbi \u003cbalbi@kernel.org\u003e\nCc: stable \u003cstable@vger.kernel.org\u003e\nLink: https://lore.kernel.org/r/20200510054326.GA19198@pizza01\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3589be72f59807b8ca79eca40bcd56159d6e51ef",
      "old_mode": 33188,
      "old_path": "drivers/usb/gadget/configfs.c",
      "new_id": "05b9adde1a179b4a52d0bc97e75ee52511d9ef4c",
      "new_mode": 33188,
      "new_path": "drivers/usb/gadget/configfs.c"
    }
  ]
}