Re: [PATCH] usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling

[Sebastian EM]

Hi Greg,

Thanks for the review.

You are right; the self Reported-by tag does not belong there, so I dropped it in v2.

The introducing commit is:

93c473948c58 ("usb: gadget: add WebUSB landing page support")

I also added:

Cc: stable@xxxxxxxxxxxxxxx

since the issue was introduced with the WebUSB GET_URL handling path and the fix is a small bounds/underflow fix suitable for stable kernels.

v2 is attached as a plain patch:

0001-v2-usb-gadget-composite-fix-integer-underflow-in-WebUSB-GET_URL-handling.patch

Thanks,
Jeremy

El mar, 12 may 2026 a las 0:40, Greg Kroah-Hartman (<gregkh@xxxxxxxxxxxxxxxxxxx>) escribió:

On Tue, May 12, 2026 at 01:43:43AM +0000, Jeremy Erazo wrote:
> The WebUSB GET_URL handler in composite_setup() narrows
> landing_page_length to fit the host-supplied wLength using
>
>       landing_page_length = w_length
>               - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset;
>
> If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the
> unsigned subtraction wraps, and the subsequent
>
>       memcpy(url_descriptor->URL,
>              cdev->landing_page + landing_page_offset,
>              landing_page_length - landing_page_offset);
>
> ends up copying close to UINT_MAX bytes from cdev->landing_page into
> cdev->req->buf.  KASAN reports a slab-out-of-bounds in composite_setup
> on the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the
> memcpy as a 4294967293-byte field-spanning write into
> url_descriptor->URL (size 252).
>
> A USB host can reach this from a single SETUP packet against any
> gadget that has webusb/use=1 and a landingPage configured.
>
> Handle the small-wLength case before the math: when the host requested
> fewer bytes than the URL descriptor header, only the header is
> meaningful and no URL bytes need to be copied.  Setting
> landing_page_length to landing_page_offset makes the existing memcpy a
> no-op and leaves the descriptor returned to the host unchanged for all
> larger wLength values.
>
> Reported-by: Jeremy Erazo <mendozayt13@xxxxxxxxx>
> Signed-off-by: Jeremy Erazo <mendozayt13@xxxxxxxxx>

You don't need a reported-by when you are the author and sign off on
something.

What commit id does this fix?  Why not backport it to stable kernels?

thanks,

greg k-h

Attachment: 0001-v2-usb-gadget-composite-fix-integer-underflow-in-WebUSB-GET_URL-handling.patch
Description: Binary data