Re: [PATCH v3] usb: uas: validate status URB length before parsing the IU

[sashiko-bot@kernel.org]

> uas_stat_cmplt() dereferences iu->tag without verifying that the
> status URB actually carried a full IU header.  The transfer buffer
> is a freshly-zeroed sense_iu, so a status URB that completes
> successfully but with a short or empty actual_length — observed in
> the wild during link-level upsets (Thunderbolt-chain xhci blips) and
> on a wedging bridge — reads back as iu_id=0/tag=0 and produces the
> misleading
> 
>   stat urb: no pending cmd for uas-tag 0
> 
> log spam seen e.g. on an ASMT135x enclosure and a Samsung T7, right
> before the affected commands time out into the error handler.
> 
> Worse, this is not just log noise: a short packet that happens to
> carry a plausible header is matched to an inflight command, and the
> untouched bytes of the zeroed buffer then stand in for fields that
> were never transferred — sense_iu.status reads as SAM_STAT_GOOD,
> falsely completing the command, and response_iu.response_code reads
> as RC_TMF_COMPLETE.
> 
> Enforce the IU header minimum before parsing the tag, then enforce
> per-IU minimums before dereferencing: STATUS IUs need at least the
> status byte, RESPONSE IUs need response_code; READ_READY and
> WRITE_READY IUs legitimately carry only the 4-byte header.
> 
> Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014165618.33800-1-olivier.kaloudoff@gmail.com?part=1