Re: [PATCH] usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()

On Mon, Aug 17, 2026 at 09:39:16PM +0530, Jeffin Philip wrote:
> On Mon, 17 Aug 2026 21:33:19 +0530, Jeffin Philip wrote:
> >Kconfig currently sets the limit from 2 to 256 with default as 2. However,
> >we use that only at build time. So, if we enter during runtime via configfs,
> >we set page content to 0\0 and get the null pointer dereference. So we will
> >need to add the check for num < 2 in fsg_opts_num_buffers_store() and return
> >EINVAL?

Or put the check in fsg_common_set_num_buffers(), which gets called on 
all the pathways.

Alan Stern

>  Upper bound is 256 which is below what kstrtou8() can return anyway.
> 
> Correction on the last sentence: Upper bound is 256 which is _above_ what 
> kstrtou8() can return anyway.