Re: [PATCH v2] usbip: vhci: do not give back URBs with an unchecked actual_length

[sashiko-bot@kernel.org]

> vhci_recv_ret_submit() copies actual_length from the RET_SUBMIT header
> into the URB, and only usbip_recv_xbuff() looks at it. That check is not
> enough:
> 
>  - an IN reply longer than transfer_buffer_length is rejected and the
>    connection shut down, but the URB is still given back with the
>    oversized actual_length (and status -EPROTO);
>  - a negative actual_length (urb->actual_length is a u32) is not
>    "> 0", so usbip_recv_xbuff() returns 0 without checking it and the
>    URB is given back with status 0;
>  - for OUT URBs usbip_recv_xbuff() returns 0 straight away, so any
>    actual_length is given back.
> 
> Completion handlers trust actual_length. usbfs copies that many bytes
> from the transfer buffer to user space in copy_urb_data_to_user(),
> [ ... ]
> (a short read), as the buffer was not filled.
> 
> Fixes: b348d7dddb6c ("USB: usbip: fix potential out-of-bounds write")
> Cc: stable@vger.kernel.org
> Signed-off-by: Vlatko Kosturjak <kost@linux.hr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/auw5_lMRbGU97IKx@griffin.linux.hr?part=1