[PATCH 0/4] usb: initialize debugfs command buffers
From: Jiale Yao
Date: Wed Oct 21 2026 - 06:51:22 EST
Several USB debugfs write handlers copy user input into uninitialized stack
buffers and then compare fixed command lengths. A short write that matches a
command prefix can therefore make strncmp() inspect uninitialized bytes.
Zero-initialize the affected command buffers so every copied input is
terminated and the comparisons do not depend on stale stack contents.
Jiale Yao (4):
usb: dwc2: initialize debugfs command buffer
usb: gadget: renesas_usb3: initialize debugfs command buffer
xhci: debugfs: initialize command buffer
usb: mtu3: initialize debugfs command buffer
drivers/usb/dwc2/debugfs.c | 2 +-
drivers/usb/gadget/udc/renesas_usb3.c | 2 +-
drivers/usb/host/xhci-debugfs.c | 2 +-
drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
--
2.34.1