[PATCH] USB: serial: sierra: validate URB length in instat callback

[PATCH] USB: serial: sierra: validate URB length in instat callback

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

sierra_instat_callback() reads one byte past the usb_ctrlrequest
header at offset sizeof(struct usb_ctrlrequest) without first
checking that urb->actual_length is large enough to contain it.
A short USB interrupt transfer could cause an out-of-bounds read.

Add a length check matching the pattern already present in the
option driver (option_instat_callback), which validates the same
field access.

Fixes: 033a3fb980b041 ("USB: Sierra Wireless driver update")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/usb/serial/sierra.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 6e443aacae07d..8f800cde25229 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -575,6 +575,11 @@ static void sierra_instat_callback(struct urb *urb)
 				__func__);
 			return;
 		}
+		if (urb->actual_length < sizeof(*req_pkt) + 1) {
+			dev_dbg(&port->dev, "%s: short interrupt transfer\n",
+				__func__);
+			return;
+		}
 		if ((req_pkt->bRequestType == 0xA1) &&
 				(req_pkt->bRequest == 0x20)) {
 			int old_dcd_state;
-- 
2.47.3

Re: [PATCH] USB: serial: sierra: validate URB length in instat callback

[sashiko-bot]

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> sierra_instat_callback() reads one byte past the usb_ctrlrequest
> header at offset sizeof(struct usb_ctrlrequest) without first
> checking that urb->actual_length is large enough to contain it.
> A short USB interrupt transfer could cause an out-of-bounds read.
> 
> Add a length check matching the pattern already present in the
> option driver (option_instat_callback), which validates the same
> field access.
> 
> Fixes: 033a3fb980b041 ("USB: Sierra Wireless driver update")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261018223352.2021650-1-tristmd@gmail.com?part=1

Re: [PATCH] USB: serial: sierra: validate URB length in instat callback

[Johan Hovold]

On Sun, Oct 18, 2026 at 10:33:52PM +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> sierra_instat_callback() reads one byte past the usb_ctrlrequest
> header at offset sizeof(struct usb_ctrlrequest) without first
> checking that urb->actual_length is large enough to contain it.
> A short USB interrupt transfer could cause an out-of-bounds read.
> 
> Add a length check matching the pattern already present in the
> option driver (option_instat_callback), which validates the same
> field access.
> 
> Fixes: 033a3fb980b041 ("USB: Sierra Wireless driver update")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  drivers/usb/serial/sierra.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
> index 6e443aacae07d..8f800cde25229 100644
> --- a/drivers/usb/serial/sierra.c
> +++ b/drivers/usb/serial/sierra.c
> @@ -575,6 +575,11 @@ static void sierra_instat_callback(struct urb *urb)
>  				__func__);
>  			return;
>  		}
> +		if (urb->actual_length < sizeof(*req_pkt) + 1) {
> +			dev_dbg(&port->dev, "%s: short interrupt transfer\n",
> +				__func__);
> +			return;
> +		}

This silently breaks a theoretical device that submits requests without
payload not yet handled by the driver (the else branch below).

Please split this up in two checks; one for the header and one for the
line state data as in the option driver.

And since you prevent any further interrupts if you ever hit this, you
should use dev_err().


>  		if ((req_pkt->bRequestType == 0xA1) &&
>  				(req_pkt->bRequest == 0x20)) {
>  			int old_dcd_state;

Johan