[PATCH 1/4] usb: dwc2: initialize debugfs command buffer

[Jiale Yao]

testmode_write() copies user input into an uninitialized stack buffer
and compares fixed command lengths. A short write matching a command
prefix can make strncmp() inspect bytes that were not initialized.

Zero-initialize the buffer so the copied input is always terminated.

Fixes: f91eea447ac3 ("usb: dwc2: move debugfs code to a separate file")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/usb/dwc2/debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/debugfs.c b/drivers/usb/dwc2/debugfs.c
index 3116ac72747f..9fedeb2e3562 100644
--- a/drivers/usb/dwc2/debugfs.c
+++ b/drivers/usb/dwc2/debugfs.c
@@ -31,7 +31,7 @@ static ssize_t testmode_write(struct file *file, const char __user *ubuf, size_t
 	struct dwc2_hsotg	*hsotg = s->private;
 	unsigned long		flags;
 	u32			testmode = 0;
-	char			buf[32];
+	char			buf[32] = { };
 
 	if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
 		return -EFAULT;
-- 
2.34.1