Re: [PATCH] usb: serial: fix slab out-of-bounds read in interrupt URB callback

[Johan Hovold <johan@kernel.org>]

On Mon, Jul 13, 2026 at 08:30:38AM +0200, Greg Kroah-Hartman wrote:
> On Mon, Jul 13, 2026 at 01:00:12AM +0800, Jiale Yao wrote:

> > @@ -2672,6 +2672,13 @@ static void option_instat_callback(struct urb *urb)
> >  			dev_dbg(dev, "%s: NULL req_pkt\n", __func__);
> >  			return;
> >  		}
> > +
> > +		if (urb->actual_length < sizeof(struct usb_ctrlrequest) + 1) {
> > +			dev_dbg(dev, "%s: short interrupt transfer: %d bytes\n",
> > +				__func__, urb->actual_length);
> > +			return;
> > +		}
> 
> Close, shouldn't this be rewritten to be:
> 
>                if (urb->actual_length < sizeof(*req_pkt) + 1) {
>                        dev_dbg(dev, "%s: short packet %u\n", __func__,
>                                urb->actual_length);
> 
> As that's the structure you need to care about instead?

The load uses sizeof(struct usb_ctrlrequest) currently so I think it's
fine to use that in the length check as well.

But looking at this again, the check should be split in two: one for the
struct usb_ctrlrequest header and one for the modem signal state (inside
the conditional).

Johan