[PATCH v4] usb: gadget: f_printer: bound PNP string copy length in printer_func_setup()

[Hui Peng]

In printer_func_setup(), when processing a GET_DEVICE_ID class setup
request, the IEEE-1284 PNP string length value = strlen(*dev->pnp_string)
is copied into buf without checking wLength (the host's requested buffer
size):

  value = strlen(*dev->pnp_string);
  memcpy(buf + 2, *dev->pnp_string, value);

When the host issues a GET_DEVICE_ID request with wLength smaller than
value + 2, memcpy() writes past the end of the transfer buffer, triggering
a slab out-of-bounds heap buffer overflow in printer_func_setup():

  BUG: KASAN: slab-out-of-bounds in printer_func_setup+0x280/0x450
  Write of size 3074 at addr ffff8880024f8000 by task init/1
  Call Trace:
   <TASK>
   dump_stack_lvl+0x70/0xa0
   print_report+0x153/0x4c6
   kasan_report+0xf1/0x120
   __asan_memcpy+0x3c/0x60
   printer_func_setup+0x280/0x450

Bound the PNP string copy length using min_t(u16, wLength, strlen() + 2) in
printer_func_setup() so memcpy() never exceeds wLength.

Tested in QEMU against Linux 7.3.0-rc3 with KASAN enabled by binding
f_printer with a 3074-byte PNP string and issuing a GET_DEVICE_ID setup
request with wLength = 64: on the unfixed kernel this triggers a KASAN
slab-out-of-bounds write, whereas on the fixed kernel value is bounded to
wLength and 0 KASAN faults occur.

Fixes: b185f01a9ab7 ("usb: gadget: printer: factor out f_printer")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
Changes in v4:
- Re-target fix strictly to bound memcpy() size against wLength in
  GET_DEVICE_ID handling in printer_func_setup().

 drivers/usb/gadget/function/f_printer.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index a27792966287..f8726e3d849f 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -1033,9 +1033,13 @@ static int printer_func_setup(struct usb_function *f,
 			if (!*dev->pnp_string) {
 				value = 0;
 				break;
 			}
-			value = strlen(*dev->pnp_string);
-			buf[0] = (value >> 8) & 0xFF;
-			buf[1] = value & 0xFF;
-			memcpy(buf + 2, *dev->pnp_string, value);
+			value = min_t(u16, wLength, strlen(*dev->pnp_string) + 2);
+			if (value >= 2) {
+				u16 length = value - 2;
+
+				buf[0] = (length >> 8) & 0xFF;
+				buf[1] = length & 0xFF;
+				memcpy(buf + 2, *dev->pnp_string, length);
+			}
 			DBG(dev, "1284 PNP String: %x %s\n", value,
 			    *dev->pnp_string);
 			break;
-- 
2.47.3