Re: usb: devio: USBFS_XFER_MAX check bypassed for iso urbs due to incorrect ordering, potential oob heap write

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Oct 15, 2026 at 10:54:31AM -0400, Alan Stern wrote:
> On Thu, Oct 15, 2026 at 08:07:49AM -0400, Reid D wrote:
> > Greg, sorry about that.
> > 
> > The fix moves the USBFS_XFER_MAX check to after totlen is computed so it
> > validates the actual transfer size used for the kmalloc.
> 
> It isn't necessary to do this.  The check you added can never be 
> violated.
> 
> To see why, read the code.  The first thing the USBDEVFS_URB_TYPE_ISO 
> case does is ensure that uurb->number_of_packets <= 128.  The loop that 
> accumulates the individual packet sizes also limits isopkt[u].length to 
> be <= 98304.  Therefore the largest possible buffer size for an 
> isochronous transfer is 128 * 98304 = 12582912.  But USBFS_XFER_MAX is 
> (UINT_MAX / 2 - 1000000) or 2146483648, which is a lot bigger (about 2 
> billion vs. 12 million).  This means the calculated value for 
> uurb->buffer_length cannot exceed USBFS_XFER_MAX.
> 
> The real point of the USBFS_XFER_MAX check is to limit the size of bulk 
> and interrupt transfers.

Awe, you spoiled the test :)

Reid, again, remember that the _BEST_ LLM right now (top of the line,
frontier model, no guardrails) makes up patches that are 50% of the time
wrong.  You MUST have a reproducer to have a LLM be able to prove it, OR
take the time to manually review it yourself.

Best of luck!

greg k-h