Re: [PATCH v2] greybus: operation: fix out-of-bounds write in message allocation

[Johan Hovold]

On Wed, Sep 02, 2026 at 10:59:16AM -0400, Adriano Cordova wrote:
> The incoming message size from the device header (header.size) is
> trusted without checking that it is at least the size of the message
> header itself, but a value smaller than sizeof(struct gb_operation_msg_hdr)
> underflows request_size in gb_operation_create_incoming(), wraps around
> in gb_operation_message_alloc(), and results in a tiny buffer that is
> then written past its end in gb_operation_message_init().

Is it really? I was under the impression the only issue here was the
potential zero-size-pointer deref.

> Reject undersized messages before parsing the message header.
> 
> Fixes: 87d208feb74f ("greybus: embed message buffer into message structure")
> Reported-by: syzbot+2fd6aefc361af86911d5@xxxxxxxxxxxxxxxxxxxxxxxxx
> Link: https://syzkaller.appspot.com/bug?extid=2fd6aefc361af86911d5
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: opencode:deepseek v4 pro
> Signed-off-by: Adriano Cordova <adrianox@xxxxxxxxx>
> ---
> v2: point the Fixes tag at the proper commit (87d208feb74f), and add an
>     Assisted-by tag.

Either way, Yang has already sent a fix for this as I mentioned before
(and which is now ready to be merged):

	https://lore.kernel.org/lkml/tencent_617A1B9F1DCD78A45A65AB7AFD8AAD84460A@xxxxxx/

Johan