[BUG] usb: core: wBytesPerInterval checked with unsanitized bMaxBurst

[BUG] usb: core: wBytesPerInterval checked with unsanitized bMaxBurst

[Cheng Yongkang]

Hi Greg, Alan,

I hit a corner case in usb_parse_ss_endpoint_companion(). It needs a
SuperSpeed device with an invalid bMaxBurst or Mult, so it may not be
worth fixing.

usb_parse_ss_endpoint_companion() clamps bMaxBurst to 15 and the isoc
Mult to 3 in ep->ss_ep_comp, but then computes max_tx for the
wBytesPerInterval check from the original descriptor. The stored
wBytesPerInterval can then be larger than the clamped endpoint can
carry.

With wMaxPacketSize=1024, bMaxBurst=16, Mult=1 and
wBytesPerInterval=65535, bMaxBurst becomes 15 but wBytesPerInterval
is set to 17408 instead of 16384. usb_submit_urb() uses the clamped
values and rejects isoc frames above 16384, while
usb_endpoint_max_periodic_payload() returns 17408, which xHCI also
uses as the Max ESIT Payload.

On v7.3 with a virtual SuperSpeed device over USB/IP, the kernel
logged "setting to 17408", and 16385- and 17000-byte isoc frames
failed with -EMSGSIZE. I only tested the bMaxBurst case; the Mult
case follows from the same code. The code is unchanged in
next-20261113.

Using ep->ss_ep_comp in the max_tx calculation fixes it:

  -		max_tx = (desc->bMaxBurst + 1) *
  -			(USB_SS_MULT(desc->bmAttributes)) *
  +		max_tx = (ep->ss_ep_comp.bMaxBurst + 1) *
  +			(USB_SS_MULT(ep->ss_ep_comp.bmAttributes)) *
   			usb_endpoint_maxp(&ep->desc);
   	else if (usb_endpoint_xfer_int(&ep->desc))
   		max_tx = usb_endpoint_maxp(&ep->desc) *
  -			(desc->bMaxBurst + 1);
  +			(ep->ss_ep_comp.bMaxBurst + 1);

I can send a patch if you want one.

Thanks,
Cheng Yongkang