From d42add27c8060de0c8cbbf00806d5c286f50e214 Mon Sep 17 00:00:00 2001 From: Tao Huang Date: Thu, 10 Jun 2021 18:37:43 +0800 Subject: [PATCH] Revert "CHROMIUM: usb: gadget: configfs: Fix KASAN use-after-free" This reverts commit d7b2c97fd05924b38edd8ed27bb443a80eb95efa. Relpaced by commit c3a4fc9f37af ("usb: gadget: configfs: Fix KASAN use-after-free"). Signed-off-by: Tao Huang Change-Id: I838bfe4ef5d3a7ba3ce4296f76434cfc3d33c991 --- drivers/usb/gadget/configfs.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index a2b0cb2ac64a..88b921e04d49 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -140,28 +140,21 @@ struct gadget_config_name { struct list_head list; }; -#define MAX_USB_STRING_LEN 126 -#define MAX_USB_STRING_WITH_NULL_LEN (MAX_USB_STRING_LEN+1) - static int usb_string_copy(const char *s, char **s_copy) { int ret; char *str; char *copy = *s_copy; ret = strlen(s); - if (ret > MAX_USB_STRING_LEN) + if (ret > 126) return -EOVERFLOW; - if (copy) { - str = copy; - } else { - str = kmalloc(MAX_USB_STRING_WITH_NULL_LEN, GFP_KERNEL); - if (!str) - return -ENOMEM; - } - strncpy(str, s, MAX_USB_STRING_WITH_NULL_LEN); + str = kstrdup(s, GFP_KERNEL); + if (!str) + return -ENOMEM; if (str[ret - 1] == '\n') str[ret - 1] = '\0'; + kfree(copy); *s_copy = str; return 0; }