Re: [PATCH v3] usb: gadget: f_uvc: fix Extension Unit descriptor heap overflow

[Andy Shevchenko]

On Mon, Aug 24, 2026 at 05:44:56PM +0800, Haofeng Li wrote:
> An Extension Unit descriptor is 24 + bNrInPins + bControlSize bytes long
> (UVC_DT_EXTENSION_UNIT_SIZE(p, n)), where bNrInPins and bControlSize are
> configfs attributes each accepted over the full 0..255 range by
> kstrtou8().  uvc_configfs stores the computed size in the u8 bLength
> field of the descriptor, so once 24 + p + n exceeds 255 it silently
> wraps: p = n = 255 describes a 534-byte descriptor with bLength = 22.
> 
> uvc_copy_descriptors() reserves xu->desc.bLength bytes per Extension Unit
> in the descriptor buffer it allocates at bind time, but
> UVC_COPY_XU_DESCRIPTOR() copies the real descriptor contents, i.e.
> 22 + bNrInPins + 1 + bControlSize + 1 bytes.  With the wrapped length the
> copy overruns the allocation by up to 512 bytes.
> 
> Attack chain (write access to a UVC gadget's configfs attributes; no
> race, no USB traffic, a single bind triggers it):
> 
>     echo 255 > .../functions/uvc.0/extensions/ext.0/b_nr_in_pins
>     echo 255 > .../functions/uvc.0/extensions/ext.0/b_control_size
>       -> uvcg_extension_b_nr_in_pins_store() /
>          uvcg_extension_b_control_size_store()
>       -> bLength = UVC_DT_EXTENSION_UNIT_SIZE(255, 255) wraps to 22
>     bind the gadget to a UDC
>       -> uvc_function_bind() -> uvc_copy_descriptors()
>       -> kmalloc() sized using the wrapped bLength: 22 bytes for the XU
>       -> UVC_COPY_XU_DESCRIPTOR() writes the real 534 bytes into that
>          slot (22-byte head, 255 baSourceID, bControlSize, 255
>          bmControls, iExtension)
>       -> heap out-of-bounds write during bind
> 
> Reproduced on 7.2.0+: a stock build (FORTIFY on) can derive the remaining
> allocation size at the bmControls memcpy and BUGs in __fortify_panic()
> during bind - a deterministic kernel crash; with FORTIFY disabled for the
> file, KASAN reports "slab-out-of-bounds Write of size 255" in
> uvc_copy_descriptors() against the kmalloc-192 descriptor buffer.
> 
> Reject combinations whose descriptor does not fit into bLength at all four
> configfs entry points that can grow an Extension Unit (b_nr_in_pins,
> b_control_size, ba_source_id, bm_controls), and make uvc_copy_descriptors()
> refuse an Extension Unit whose bLength does not match its contents instead
> of overflowing the buffer.
> 
> Fixes: 0525210c9840 ("usb: gadget: uvc: Allow definition of XUs in configfs")
> Signed-off-by: Haofeng Li <lihaofeng@xxxxxxxxxx>
> Assisted-by: opencode:deepseek-v4-flash-free
> 
> Reviewed-by: Daniel Scally <dan.scally@xxxxxxxxxxxxxxxx>

Should be no blank lines in the tag block. You may use `b4` tool (check your
Linux distro for the respective package) to automate that.

-- 
With Best Regards,
Andy Shevchenko