Re: [PATCH v7 2/3] usb: gadget: f_tcm: reject a short write data-out transfer

[sashiko-bot@kernel.org]

> usbg_data_write_cmpl() copies se_cmd->data_length bytes out of the bounce
> buffer into the command's scatter-gather list without checking how much the
> host actually sent.  A BOT host can declare a larger OUT transfer than it
> delivers and end the data stage with a short packet: req->actual is then
> shorter than req->length, but the completion handler still commits the full
> declared length.  The tail past req->actual is whatever was already in the
> kmalloc'd bounce buffer, which is not zeroed, so uninitialised kernel heap
> is written to the backing store and can be read back by the host.
> 
> Fail the command when req->actual does not match req->length instead of
> committing the stale tail.  By the time usbg_data_write_cmpl() runs the OUT
> data request has completed, so mark the command and skip the ep_out drain
> in bot_send_bad_status() - there is nothing left on the wire, and draining
> it re-arms ep_out for data the host already finished sending and wedges the
> bulk pipe.  This mirrors how f_mass_storage stops draining once the host
> ends the OUT stage.  A command rejected before its data stage still drains,
> since the host has yet to send it.
> 
> A short 8192/4096 WRITE then commits nothing to the backing store instead
> of 4096 bytes of stale heap, and no OUT drain is queued.
> 
> Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013073328.2936318-1-yhlee@isslab.korea.ac.kr?part=2