Re: usb: devio: USBFS_XFER_MAX check bypassed for iso urbs due to incorrect ordering, potential oob heap write

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Oct 15, 2026 at 08:07:49AM -0400, Reid D wrote:
> Greg, sorry about that.
> 
> The fix moves the USBFS_XFER_MAX check to after totlen is computed so it
> validates the actual transfer size used for the kmalloc.
> 
> On Thu, Oct 15, 2026 at 8:02 AM Greg KH <gregkh@linuxfoundation.org> wrote:
> 
> > On Thu, Oct 15, 2026 at 07:30:26AM -0400, Reid D wrote:
> > > Greg,
> > >
> > > Please check out the fix,
> >
> > <snip>
> >
> > For some reason you sent this only to me, which is a bit rude to
> > everyone else on the mailing list.  I'll be glad to respond if you
> > resend it to everyone.
> >
> > thanks,
> >
> > greg k-h
> >

> From e3b32fafac13bc84183624fabc616cdcf3719cad Mon Sep 17 00:00:00 2001
> From: "Reid Downing (b1nv0id)" <skibletz@gmail.com>
> Date: Thu, 15 Oct 2026 07:24:20 -0400
> Subject: [PATCH] usb: devio: fix USBFS_XFER_MAX check ordering for iso urbs
> 
> Signed-off-by: Reid Downing (b1nv0id) <skibletz@gmail.com>
> ---
>  drivers/usb/core/devio.c | 20 +++++++++++---------
>  1 file changed, 11 insertions(+), 9 deletions(-)

Please point your llm at the docs to show how to create a real patch
(hint you need a changelog and it can't be attached.)

Also please test your patch so that you know it actually fixes the issue
you are reporting.  Remember a huge % of llm-found bugs are actually not
bugs at all, you need to make a patch (which you did here, so that cuts
the odds down to 50%) and then test it (which cuts down the number even
more.)

thanks,

greg k-h