From 9ee83ef8d24f11feb55fd0d222c0ec19f09dbd3f Mon Sep 17 00:00:00 2001 From: Yizhou Zhao Date: Sun, 7 Jun 2026 20:19:04 +0800 Subject: [PATCH] net/9p/usbg: fix prefix matching in device lookup p9_usbg_create() matches the mount source against registered usb9pfs instance tags with strncmp() and the length of the caller supplied source. That accepts any prefix of the registered tag. For example, a gadget instance tagged "secret_channel" can be selected with "s", "sec", or any other non-empty prefix. Once selected, the instance is marked in use and the client is attached to that transport. This differs from the configfs tag lookup path, which uses strcmp() and therefore requires an exact tag match. Require an exact tag match in p9_usbg_create() as well. Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport") Cc: stable@vger.kernel.org Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Ao Wang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Assisted-by: GLM:GLM-5.1 Signed-off-by: Yizhou Zhao Co-developed-by: Jackie Liu Signed-off-by: Jackie Liu Message-ID: <20260607121907.12588-1-zhaoyz24@mails.tsinghua.edu.cn> Message-ID: <20260719040346.88295-1-liu.yun@linux.dev> Signed-off-by: Dominique Martinet --- net/9p/trans_usbg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c index 23056b803ddf..021631d63318 100644 --- a/net/9p/trans_usbg.c +++ b/net/9p/trans_usbg.c @@ -391,7 +391,7 @@ static int p9_usbg_create(struct p9_client *client, struct fs_context *fc) guard(mutex)(&usb9pfs_lock); list_for_each_entry(dev, &usbg_instance_list, usb9pfs_instance) { - if (!strncmp(devname, dev->tag, strlen(devname))) { + if (!strcmp(devname, dev->tag)) { if (!dev->inuse) { dev->inuse = true; found = 1;