[PATCH v2 0/2] usb: gadget: configfs: fix extended property length handling

[Yingjie Wang]

The configfs implementation of Microsoft OS Extended Properties keeps the
raw property payload in memory while data_len records the descriptor wire
length.  The Unicode wire length includes a two-byte terminator, but the
stored allocation did not.  Configfs readback and descriptor conversion
could consequently read one byte past the allocation.

Type changes also updated data_len with shifts that omitted the Unicode
terminator and left the aggregate descriptor length unchanged.  This could
truncate a property value, report a stale dwLength, or make configfs
readback use a length larger than the allocation.

Patch 1 allocates the source terminator, guards empty writes and introduces
the raw-to-wire length helper.  Patch 2 keeps the raw data length separately,
derives Unicode wire lengths from the actual UTF-16 conversion, uses both
lengths for type changes and readback, and updates the aggregate descriptor
length.  Configfs now returns the raw payload, while the host-visible Unicode
descriptor retains its UTF-16 terminator.

Changes since v1:
- use separate raw and wire lengths instead of inferring UTF-8 bytes from
  a UTF-16 wire length;
- derive Unicode wire lengths from UTF-16 code units, including the
  terminator, so non-ASCII values are not padded with extra zero units;
- return only the raw payload through configfs readback;
- keep data_len and the aggregate descriptor length consistent across type
  changes;
- calculate the type-dependent length and publish the new data under
  opts_mutex;
- guard empty data writes before checking the trailing byte;
- preserve the FunctionFS Unicode conversion input length while adapting the
  shared serializer;
- reject malformed UTF-8 without replacing the existing property data or
  changing its descriptor lengths;
- include the related type-change fix as patch 2/2.

Tested on x86-64 with KASAN using an RNDIS configfs gadget on dummy_hcd.
The base kernel reported out-of-bounds reads in configfs readback and host
descriptor generation.  Patch 1 removed the direct Unicode-data reports;
the full series also removed the type-change report, with no KASAN, BUG or
WARNING.  Binary-to-Unicode, Unicode-to-binary, data-before-type, property
removal and type 7 configfs readback were exercised.  ASCII, U+00E9 and
U+1F600 values produced exact UTF-16 data lengths and terminators, including
through a binary-to-Unicode transition.  Every host descriptor length
matched the returned response, and configfs returned the raw bytes.  An
invalid UTF-8 write failed without changing the old data, type or host
descriptor.  A separate FunctionFS run returned the complete "abc\0" Unicode
property and preserved a four-byte Binary property containing an embedded
NUL.  Both commits also built with W=1 for x86-64 and i386.

Yingjie Wang (2):
  usb: gadget: configfs: NUL-terminate extended property data
  usb: gadget: configfs: keep extended property lengths consistent

 drivers/usb/gadget/composite.c     |   1 +
 drivers/usb/gadget/configfs.c      | 100 +++++++++++++++++++----------
 drivers/usb/gadget/function/f_fs.c |   1 +
 drivers/usb/gadget/u_os_desc.h     |   8 +--
 include/linux/usb/composite.h      |   4 +-
 5 files changed, 76 insertions(+), 38 deletions(-)


base-commit: e971f4f365bad51d01bc90db55b56fdb3124f963
-- 
2.43.0