[PATCH] usbip: clear actual length after receive failure

[PATCH] usbip: clear actual length after receive failure

[Sung Byeongchan]

A USB/IP peer supplies actual_length in RET_SUBMIT. usbip_recv_xbuff()
rejects a value larger than the URB transfer buffer, but the VHCI error
path gives the URB back with the peer-controlled length still present.
usbfs subsequently uses urb->actual_length as its copy-to-userspace
extent, reading beyond the transfer-buffer allocation.

On current mainline target 0c2669a9f4a1d, a 65-byte completion for a
64-byte URB produced a KASAN slab-out-of-bounds read in _copy_to_user in
three fresh boots. INT_MAX reproduced the same first invalid consumer
three times. The one-byte case modified only a boolean sentinel oracle;
the copied value was not collected or characterized.

Clear actual_length when receiving the transfer buffer fails. No payload
is valid on this error path, and zero prevents downstream consumers from
reusing the rejected extent. The existing protocol-error path closes the
broken transport.

The fixed kernel rejected both triggers without KASAN in three fresh
boots each. Normal zero through buffer-length completions, OUT and ISO
controls, high-bit counterexamples, disconnect cleanup, and a following
valid transfer on a fresh transport remained functional.

This issue was found through manual source inspection assisted by an
AI/LLM, then evaluated with local production-path dynamic validation.

Fixes: aabb5b833872 ("usbip: Fix error path of vhci_recv_ret_submit()")
Assisted-by: LLM
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
---
 drivers/usb/usbip/vhci_rx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
index a678e7c898375..741107a964660 100644
--- a/drivers/usb/usbip/vhci_rx.c
+++ b/drivers/usb/usbip/vhci_rx.c
@@ -79,6 +79,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
 	/* recv transfer buffer */
 	if (usbip_recv_xbuff(ud, urb) < 0) {
 		urb->status = -EPROTO;
+		urb->actual_length = 0;
 		goto error;
 	}
 
-- 
2.43.0

Re: [PATCH] usbip: clear actual length after receive failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] usbip: incomplete fix for OOB read due to signedness bug in usbip_recv_xbuff
--

commit ba9987eb570270d32daa1e8937dfdcfa997cbe46
Author: Sung Byeongchan <tjdqudcks0424@naver.com>

usbip: clear actual length after receive failure

Clear actual_length when receiving the transfer buffer fails. No payload
is valid on this error path, and zero prevents downstream consumers from
reusing the rejected extent.

> diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
> index a678e7c898375..741107a964660 100644
> --- a/drivers/usb/usbip/vhci_rx.c
> +++ b/drivers/usb/usbip/vhci_rx.c
> @@ -79,6 +79,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
>  	/* recv transfer buffer */
>  	if (usbip_recv_xbuff(ud, urb) < 0) {
>  		urb->status = -EPROTO;
> +		urb->actual_length = 0;

[Severity: High]
Does this completely prevent the out-of-bounds read if a malicious USB/IP
server provides a high-bit length like 0x80000000?

Looking at usbip_recv_xbuff() in drivers/usb/usbip/usbip_common.c,
urb->actual_length (which is a u32) is assigned to a signed int:

	int size;
	...
	} else {
		/* the direction of urb must be IN. */
		if (usb_pipeout(urb->pipe))
			return 0;

		size = urb->actual_length;
	}

	/* no need to recv xbuff */
	if (!(size > 0))
		return 0;

Because size is a signed int, a high-bit value becomes negative, making the
(!(size > 0)) check evaluate to true. This causes usbip_recv_xbuff() to
return 0 (success) early, completely bypassing the bounds check against
urb->transfer_buffer_length.

Since usbip_recv_xbuff() falsely reports success for these high-bit values,
it appears this new mitigation will be skipped entirely. This would allow
the URB to complete with the massive actual_length intact, still triggering
the KASAN out-of-bounds read in usbfs.

>  		goto error;
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009122636.642575-1-tjdqudcks0424@naver.com?part=1