Re: [PATCH v3] greybus: operation: fix NULL-deref on short request

[Johan Hovold]

On Fri, Sep 04, 2026 at 04:08:20PM +0800, Yang Zi wrote:
> gb_connection_recv() accepts a received message whose advertised size is
> smaller than struct gb_operation_msg_hdr.  In particular, a header with a
> size of zero passes the incomplete-message check and reaches
> gb_operation_create_incoming().
> 
> The subtraction used to derive the request payload size then underflows.
> When gb_operation_message_alloc() adds the header size, the result wraps
> to zero, bypassing the maximum-buffer-size check.  kzalloc(0) returns
> ZERO_SIZE_PTR and gb_operation_message_init() subsequently dereferences
> it.
> 
> Reject advertised sizes smaller than the message header.  Also check the
> payload size before adding the header size, so that the size calculation
> cannot wrap and bypass the buffer-size limit.
> 
> This issue was found using a locally modified syzkaller.  The
> analysis and fix were assisted by GPT-5.6.
> 
> Fixes: d90c25b0a279 ("greybus: let operation layer examine incoming data")

This one should also be backported:

Cc: stable@xxxxxxxxxxxxxxx

> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Yang Zi <2959243019@xxxxxx>
> ---

You should put a short change log here (after ---) when revising
patches.

No need to resend this time, but keep in mind for the future.

Reviewed-by: Johan Hovold <johan@xxxxxxxxxx>

Johan