[PATCH 4/4] usb: mtu3: initialize debugfs command buffer

[Jiale Yao]

ssusb_mode_write() copies user input into an uninitialized stack buffer
and compares fixed command lengths. A short write matching a command
prefix can make strncmp() inspect bytes that were not initialized.

Zero-initialize the buffer so the copied input is always terminated.

Fixes: 4aab6ad24a10 ("usb: mtu3: move vbus and mode debugfs interfaces into mtu3_debugfs.c")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
index c003049bafbf..8976dbfaa585 100644
--- a/drivers/usb/mtu3/mtu3_debugfs.c
+++ b/drivers/usb/mtu3/mtu3_debugfs.c
@@ -423,7 +423,7 @@ static ssize_t ssusb_mode_write(struct file *file, const char __user *ubuf,
 {
 	struct seq_file *sf = file->private_data;
 	struct ssusb_mtk *ssusb = sf->private;
-	char buf[16];
+	char buf[16] = { };
 
 	if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
 		return -EFAULT;
-- 
2.34.1