Re: [PATCH v2] media: ttusb-dec: validate command request and response lengths

George Emmanuel Thomas <[email protected]> Sun, 16 Aug 2026 13:00:06 +0530

Newsgroups	org.kernel.vger.linux-media,org.kernel.vger.linux-kernel
Message-ID	<[email protected]>

Hi Pengpeng,

I tested this patch with a malformed USB response that previously
triggered a KASAN slab-out-of-bounds in ttusb_dec_send_command() with
a reported read size of 75 bytes.

With this patch applied, the same reproducer reports:

  ttusb_dec_send_command: invalid result length 75
  ttusb-dec 1-1:1.0: probe with driver ttusb-dec failed with error -71

There is no KASAN report, and the reproducer exits normally.

Tested-by: George Emmanuel Thomas <[email protected]>

Thanks,
George