Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d8cbbbc7 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "CHROMIUM: usb: gadget: configfs: Fix KASAN use-after-free"

parents 9d03c16e 9c207d3c
Loading
Loading
Loading
Loading
+12 −5
Original line number Diff line number Diff line
@@ -130,21 +130,28 @@ struct gadget_config_name {
	struct list_head list;
};

#define MAX_USB_STRING_LEN	126
#define MAX_USB_STRING_WITH_NULL_LEN	(MAX_USB_STRING_LEN+1)

static int usb_string_copy(const char *s, char **s_copy)
{
	int ret;
	char *str;
	char *copy = *s_copy;
	ret = strlen(s);
	if (ret > 126)
	if (ret > MAX_USB_STRING_LEN)
		return -EOVERFLOW;

	str = kstrdup(s, GFP_KERNEL);
	if (copy) {
		str = copy;
	} else {
		str = kmalloc(MAX_USB_STRING_WITH_NULL_LEN, GFP_KERNEL);
		if (!str)
			return -ENOMEM;
	}
	strncpy(str, s, MAX_USB_STRING_WITH_NULL_LEN);
	if (str[ret - 1] == '\n')
		str[ret - 1] = '\0';
	kfree(copy);
	*s_copy = str;
	return 0;
}