From: Vlatko Kosturjak <kost@linux.hr>
To: sashiko-reviews@lists.linux.dev
Cc: Vlatko Kosturjak <kost@linux.hr>, linux-usb@vger.kernel.org
Subject: Re: [PATCH] usbip: vhci: do not give back URBs with an unchecked actual_length
Date: Wed, 4 Nov 2026 08:22:20 +0100 [thread overview]
Message-ID: <aurdLBmNnDfGjJVz@griffin.linux.hr> (raw)
In-Reply-To: <sashiko-outbox-196735@kernel.org>
On Wed, Nov 04, 2026 at 06:16:14AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] usbip: vhci: negative wire actual_length bypasses usbip_recv_xbuff() check
The review is right: a negative actual_length (usbip_recv_xbuff() skips
it and the URB is given back with status 0) and OUT URBs (never checked)
are not covered by v1. I reproduced both on 7.4-rc1; with a URB that
usbfs splits into scatterlist chunks, a negative length over-reads the
last chunk by up to 16 KiB.
Please don't apply v1. v2 checks actual_length against
transfer_buffer_length right after unpacking the header, for IN and OUT;
I'll send it after giving v1 a day for other comments.
--
Vlatko Kosturjak - KoSt
prev parent reply other threads:[~2026-11-04 7:22 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-04 6:06 [PATCH] usbip: vhci: do not give back URBs with an unchecked actual_length Vlatko Kosturjak
2026-11-04 6:16 ` sashiko-bot
2026-11-04 7:22 ` Vlatko Kosturjak [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aurdLBmNnDfGjJVz@griffin.linux.hr \
--to=kost@linux.hr \
--cc=linux-usb@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.