Re: [PATCH] usbip: vhci: validate number_of_packets in RET_SUBMIT response

[Greg KH <gregkh@linuxfoundation.org>]

On Sun, Mar 29, 2026 at 06:53:33AM -0600, Sebastian Josue Alba Vives wrote:
> From: Sebastián Alba Vives <sebasjosue84@gmail.com>
> 
> vhci_recv_ret_submit() calls usbip_pack_pdu() which overwrites
> urb->number_of_packets with the value from the network PDU reply
> without any validation. A malicious USB/IP server can set
> number_of_packets to a value larger than the original URB allocation,
> causing usbip_recv_iso() and usbip_pad_iso() to access
> urb->iso_frame_desc[] entries beyond the allocated array.
> 
> This leads to a heap buffer overflow in kernel memory, reachable over
> the network without authentication.
> 
> The attack chain is:
>   1. Client sends isochronous URB with number_of_packets = N
>   2. Server replies with number_of_packets = N' >> N
>   3. usbip_pack_pdu() blindly copies N' into urb->number_of_packets
>   4. usbip_recv_iso() loops N' times over iso_frame_desc[N] → OOB
>   5. usbip_pad_iso() also loops N' times → second OOB
> 
> Save the original number_of_packets before usbip_pack_pdu() and
> validate the returned value does not exceed it. Also add a defensive
> bounds check in usbip_recv_iso() against USBIP_MAX_ISO_PACKETS and
> use array_size() to prevent integer overflow in the allocation.
> 
> Note that stub_rx.c already validates number_of_packets against
> USBIP_MAX_ISO_PACKETS for CMD_SUBMIT on the server side, but no
> equivalent validation existed on the client side for RET_SUBMIT.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Sebastián Alba Vives <sebasjosue84@gmail.com>
> ---
>  drivers/usb/usbip/usbip_common.c | 18 ++++++++++++++----
>  drivers/usb/usbip/vhci_rx.c      | 27 +++++++++++++++++++++++++++
>  2 files changed, 41 insertions(+), 4 deletions(-)

Please see this series:
	https://lore.kernel.org/r/20260325104841.8282-1-addcontent08@gmail.com

and this follow-on:
	https://lore.kernel.org/r/20260327064449.735-1-nathan.c.rebello@gmail.com

and if both of your patches are still relevant after applying them,
great, send them on as a follow-on patch please.

thanks,

greg k-h