Re: [PATCH] usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling

[Greg Kroah-Hartman]

On Tue, May 12, 2026 at 01:43:43AM +0000, Jeremy Erazo wrote:
> The WebUSB GET_URL handler in composite_setup() narrows
> landing_page_length to fit the host-supplied wLength using
> 
> 	landing_page_length = w_length
> 		- WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset;
> 
> If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the
> unsigned subtraction wraps, and the subsequent
> 
> 	memcpy(url_descriptor->URL,
> 	       cdev->landing_page + landing_page_offset,
> 	       landing_page_length - landing_page_offset);
> 
> ends up copying close to UINT_MAX bytes from cdev->landing_page into
> cdev->req->buf.  KASAN reports a slab-out-of-bounds in composite_setup
> on the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the
> memcpy as a 4294967293-byte field-spanning write into
> url_descriptor->URL (size 252).
> 
> A USB host can reach this from a single SETUP packet against any
> gadget that has webusb/use=1 and a landingPage configured.
> 
> Handle the small-wLength case before the math: when the host requested
> fewer bytes than the URL descriptor header, only the header is
> meaningful and no URL bytes need to be copied.  Setting
> landing_page_length to landing_page_offset makes the existing memcpy a
> no-op and leaves the descriptor returned to the host unchanged for all
> larger wLength values.
> 
> Reported-by: Jeremy Erazo <mendozayt13@xxxxxxxxx>
> Signed-off-by: Jeremy Erazo <mendozayt13@xxxxxxxxx>

You don't need a reported-by when you are the author and sign off on
something.

What commit id does this fix?  Why not backport it to stable kernels?

thanks,

greg k-h