Re: [PATCH] usb: image: mdc800: change kmalloc() to kzalloc()

[Greg Kroah-Hartman]

On Tue, Sep 01, 2026 at 02:17:54PM +0200, Oliver Neukum wrote:
> 
> 
> On 19.08.26 12:04, Griffin Kroah-Hartman wrote:
> > Change the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and
> > download_urb_buffer to kzalloc(), avoiding potential stack leaks if a
> > shorter message is received in mdc800_usb_irq() and
> > mdc800_usb_download_notify()
> 
> Hi,
> 
> thanks for the patch, but is this the right approach?
> If we get too short a reply we shouldn't process it
> at all.

The last time we tried to do that, we broke a bunch of CAN drivers
because they ended up sending "short" messages that no one noticed :(

With old hardware like this, let's just stick to this "obviously
correct" patch, and if someone with the hardware ever shows up, we can
then test short message information like this.  As-is, this prevents a
simple "leak kernel memory to userspace with a hand-crafted-device" bug.

thanks,

greg k-h