Re: [PATCH] usb: core: devio: add defensive bounds check for len2 in do_proc_bulk()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Fri, Sep 04, 2026 at 06:29:58AM +0000, rivaldihormat-debug wrote:
> Although the USB host controller hardware prevents len2 from exceeding
> len1 in normal operation via babble error handling, add an explicit
> kernel-side check to improve robustness. This helps prevent unexpected
> behavior in virtualized environments where emulation bugs might break
> this guarantee.

Then that emulation environment is very very broken, please fix that.

> Clamp len2 to len1 if it exceeds the allocated buffer size and log
> a warning message.
> 
> Signed-off-by: rivaldihormat-debug <rivaldihormat@example.com>

Not a valid name to use here :(


> ---
>  drivers/usb/core/devio.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
> index 101cb9425480..9d8930853e8f 100644
> --- a/drivers/usb/core/devio.c
> +++ b/drivers/usb/core/devio.c
> @@ -1343,6 +1343,10 @@ static int do_proc_bulk(struct usb_dev_state *ps,
>  		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
>  
>  		if (!i && len2) {
> +                        if (len2 > len1) {
> +                                dev_warn(&dev->dev, "USB returned more data than expected\n");
> +                                len2 = len1;

This isn't even a good way to handle this error if it happened :(