[PATCH v2 1/2] usb: gadget: configfs: NUL-terminate extended property data

[Yingjie Wang]

Unicode extended properties include a UTF-16 terminator in their wire
length.  The configfs store path keeps the raw UTF-8 bytes, but the
configfs readback and descriptor conversion consume the source byte
implied by that terminator-inclusive length.

The allocation currently contains only the input bytes, so both paths
can read one byte past it.  Allocate the trailing NUL with kmemdup_nul()
and centralize the raw-to-wire length conversion used by the store path.
Avoid dereferencing page[-1] on an empty configfs write.

Fixes: 7419485f197c ("usb: gadget: configfs: OS Extended Properties descriptors support")
Reported-by: Bingquan Chen <patzilla007@xxxxxxxxx>
Link: https://lore.kernel.org/r/20260421141010.5607-1-patzilla007@xxxxxxxxx
Suggested-by: Neill Kapron <nkapron@xxxxxxxxxx>
Link: https://lore.kernel.org/r/179338899796.2590875.15337207674245295434.b4-review@b4
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 drivers/usb/gadget/configfs.c | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 51df6d1d1487a..f5fff213d7952 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1283,6 +1283,21 @@ static inline struct usb_os_desc_ext_prop
 	return container_of(item, struct usb_os_desc_ext_prop, item);
 }
 
+static bool ext_prop_is_unicode_string(u8 type)
+{
+	return type == USB_EXT_PROP_UNICODE ||
+	       type == USB_EXT_PROP_UNICODE_ENV ||
+	       type == USB_EXT_PROP_UNICODE_LINK;
+}
+
+static int ext_prop_data_wire_len(u8 type, int raw_len)
+{
+	if (ext_prop_is_unicode_string(type))
+		return 2 * raw_len + 2;
+
+	return raw_len;
+}
+
 static ssize_t ext_prop_type_show(struct config_item *item, char *page)
 {
 	return sprintf(page, "%d\n", to_usb_os_desc_ext_prop(item)->type);
@@ -1332,9 +1347,7 @@ static ssize_t ext_prop_data_show(struct config_item *item, char *page)
 	struct usb_os_desc_ext_prop *ext_prop = to_usb_os_desc_ext_prop(item);
 	int len = ext_prop->data_len;
 
-	if (ext_prop->type == USB_EXT_PROP_UNICODE ||
-	    ext_prop->type == USB_EXT_PROP_UNICODE_ENV ||
-	    ext_prop->type == USB_EXT_PROP_UNICODE_LINK)
+	if (ext_prop_is_unicode_string(ext_prop->type))
 		len >>= 1;
 	memcpy(page, ext_prop->data, len);
 
@@ -1349,9 +1362,9 @@ static ssize_t ext_prop_data_store(struct config_item *item,
 	char *new_data;
 	size_t ret_len = len;
 
-	if (page[len - 1] == '\n' || page[len - 1] == '\0')
+	if (len && (page[len - 1] == '\n' || page[len - 1] == '\0'))
 		--len;
-	new_data = kmemdup(page, len, GFP_KERNEL);
+	new_data = kmemdup_nul(page, len, GFP_KERNEL);
 	if (!new_data)
 		return -ENOMEM;
 
@@ -1360,16 +1373,8 @@ static ssize_t ext_prop_data_store(struct config_item *item,
 	kfree(ext_prop->data);
 	ext_prop->data = new_data;
 	desc->ext_prop_len -= ext_prop->data_len;
-	ext_prop->data_len = len;
+	ext_prop->data_len = ext_prop_data_wire_len(ext_prop->type, len);
 	desc->ext_prop_len += ext_prop->data_len;
-	if (ext_prop->type == USB_EXT_PROP_UNICODE ||
-	    ext_prop->type == USB_EXT_PROP_UNICODE_ENV ||
-	    ext_prop->type == USB_EXT_PROP_UNICODE_LINK) {
-		desc->ext_prop_len -= ext_prop->data_len;
-		ext_prop->data_len <<= 1;
-		ext_prop->data_len += 2;
-		desc->ext_prop_len += ext_prop->data_len;
-	}
 	if (desc->opts_mutex)
 		mutex_unlock(desc->opts_mutex);
 	return ret_len;
-- 
2.43.0