Re: [PATCH] usbip: clear actual length after receive failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] usbip: incomplete fix for OOB read due to signedness bug in usbip_recv_xbuff
--

commit ba9987eb570270d32daa1e8937dfdcfa997cbe46
Author: Sung Byeongchan <tjdqudcks0424@naver.com>

usbip: clear actual length after receive failure

Clear actual_length when receiving the transfer buffer fails. No payload
is valid on this error path, and zero prevents downstream consumers from
reusing the rejected extent.

> diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
> index a678e7c898375..741107a964660 100644
> --- a/drivers/usb/usbip/vhci_rx.c
> +++ b/drivers/usb/usbip/vhci_rx.c
> @@ -79,6 +79,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
>  	/* recv transfer buffer */
>  	if (usbip_recv_xbuff(ud, urb) < 0) {
>  		urb->status = -EPROTO;
> +		urb->actual_length = 0;

[Severity: High]
Does this completely prevent the out-of-bounds read if a malicious USB/IP
server provides a high-bit length like 0x80000000?

Looking at usbip_recv_xbuff() in drivers/usb/usbip/usbip_common.c,
urb->actual_length (which is a u32) is assigned to a signed int:

	int size;
	...
	} else {
		/* the direction of urb must be IN. */
		if (usb_pipeout(urb->pipe))
			return 0;

		size = urb->actual_length;
	}

	/* no need to recv xbuff */
	if (!(size > 0))
		return 0;

Because size is a signed int, a high-bit value becomes negative, making the
(!(size > 0)) check evaluate to true. This causes usbip_recv_xbuff() to
return 0 (success) early, completely bypassing the bounds check against
urb->transfer_buffer_length.

Since usbip_recv_xbuff() falsely reports success for these high-bit values,
it appears this new mitigation will be skipped entirely. This would allow
the URB to complete with the massive actual_length intact, still triggering
the KASAN out-of-bounds read in usbfs.

>  		goto error;
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009122636.642575-1-tjdqudcks0424@naver.com?part=1