Re: [PATCH v2] usb: usbfs: clamp actual_length to transfer_buffer_length

[sashiko-bot@kernel.org]

> usbfs uses urb->actual_length from the host controller driver without
> checking it against the buffer it allocated. For a completed
> non-isochronous IN URB, processcompl() and processcompl_compat() copy
> that many bytes to userspace and report the same value, and
> async_completed() passes it to snoop_urb_data() when usbfs_snoop is
> enabled.
> 
> With USB/IP, the value comes from the remote peer. If the peer returns
> actual_length=88 for a 24-byte control-IN transfer, usbip_recv_xbuff()
> rejects the length, but VHCI still gives back the URB with -EPROTO and
> actual_length=88. usbfs copies data from failed URBs too, since they
> can carry valid partial data, so reaping the URB reads past the buffer:
> 
>   BUG: KASAN: slab-out-of-bounds in _copy_to_user
>    copy_urb_data_to_user
> [ ... ]
> 
> Fixes: 0880aef49e40a ("USB: usbfs_snoop: add data logging back in")
> Fixes: d4a4683ca054e ("USB: usbfs: only copy the actual data received")
> Cc: stable@vger.kernel.org
> Signed-off-by: Cheng Yongkang <teel4res@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261101070651.1846947-1-teel4res@gmail.com?part=1