Re: [PATCH] greybus: manifest: validate string descriptor header

[Greg Kroah-Hartman]

On Mon, Jul 06, 2026 at 05:19:35PM +0800, Pengpeng Hou wrote:
> identify_descriptor() computes a string descriptor size from
> desc->string.length.
> 
> Require the descriptor to contain the fixed string descriptor header
> before reading the variable string length. The existing descriptor-size
> check then reports the short descriptor.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
>  drivers/greybus/manifest.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/greybus/manifest.c b/drivers/greybus/manifest.c
> index 9be5d95da587..3b685ace2036 100644
> --- a/drivers/greybus/manifest.c
> +++ b/drivers/greybus/manifest.c
> @@ -122,6 +122,8 @@ static int identify_descriptor(struct gb_interface *intf,
>  	switch (desc_header->type) {
>  	case GREYBUS_TYPE_STRING:
>  		expected_size += sizeof(struct greybus_descriptor_string);
> +		if (desc_size < expected_size)
> +			break;

Nice, but how was this tested?  How was it found?

thanks,

greg k-h