Re: [PATCH v2 10/11] usb: xhci: Fix bounce buffer overflow

[sashiko-bot@kernel.org]

> From: Michal Pecio <michal.pecio@gmail.com>
> 
> High-speed devices with out of spec 1024 byte bulk endpoints exist and
> are allowed by USB core, but xhci-hcd always sets packet size to 512.
> The exact nature of these devices isn't documented, commit fb5ee84ea72c
> ("USB: Accept bulk endpoints with 1024-byte maxpacket") only states
> that they "don't work with xHCI host controllers", whatever it means.
> 
> But somebody (or a malicious device) can try, and then the driver will
> allocate a 512 byte bounce buffer for this endpoint and may write up to
> 1024 bytes into it if particular scatter-gather URBs are used, because
> xhci_align_td() obtains packet size from the descriptor. Fix this.
> 
> As a side effect, TRBs will be aligned to the packet size chosen by the
> driver on all endpoints of all speeds. Alignment serves the xHC, not
> device, so this is fine. Only out of spec devices are affected anyway.
> 
> Reported-by: co+fd80bc5967eb22c3@bugs.sh
> Link: https://lore.kernel.org/linux-usb/D4tcSGerkYkIV1DmaUo1t8TaR5qQElDLkidn@bugs.sh/
> Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
> Cc: stable@vger.kernel.org
> Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009151624.618967-1-mathias.nyman@linux.intel.com?part=10