Re: usb: devio: USBFS_XFER_MAX check bypassed for iso urbs due to incorrect ordering, potential oob heap write

[Greg KH <gregkh@linuxfoundation.org>]

On Wed, Oct 14, 2026 at 05:36:56PM -0400, Reid D wrote:
> usb: devio: USBFS_XFER_MAX check bypassed for iso urbs
> due to incorrect ordering, potential oob heap write
> 
> file: drivers/usb/core/devio.c
> function: proc_do_submiturb()
> ioctl: USBDEVFS_SUBMITURB
> 
> the bug:
> 
> the size check at line 1647 runs on buffer_length before the iso
> path has computed totlen. the iso path then overwrites buffer_length
> with totlen at line 1768, so the check never actually validates
> the real transfer size.
> 
>     line 1647 - check runs here on the wrong value:
>     if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
>         return -EINVAL;
> 
>     line 1768 - real value computed after the check:
>     uurb->buffer_length = totlen;
> 
>     line 1843 - kmalloc uses the unchecked value:
>     as->urb->transfer_buffer = kmalloc(uurb->buffer_length, ...);
> 
> impact:
> 
> if totlen exceeds the kmalloc allocation size, the copy_from_user
> that follows writes past the end of the heap buffer. for an out
> transfer the user controls both the length and the data, giving a
> heap write-what-where primitive.
> 
> current constants (128 packets * 98304 max each = 12mb) keep
> totlen below USBFS_XFER_MAX (16mb) so this is not exploitable
> today. the check ordering is structurally wrong regardless and
> will become a live bug if those constants change.
> 
> fix:
> 
>     uurb->buffer_length = totlen;
>     if (uurb->buffer_length >= USBFS_XFER_MAX)
>         return -EINVAL;
> 

Great, please turn this into a real patch that can be applied so you get
full credit for resolving this.  Your favorite llm can easily do this
for you (and it can test it, which you really should also do...)

thanks,

greg k-h