Re: [PATCH] usb: misc: usbio: fix bulk receive overread

On Thu, Aug 06, 2026 at 03:43:11PM +0200, Griffin Kroah-Hartman wrote:
> Add a check for bpkt_len being more than what was actually sent from the
> device in usbio_bulk_msg().
> 
> A malicious device could use this vulnerability to claim that more data
> was sent, when in reality it was not, leading to an OOB read later on
> with the memcpy at the end of the function.
> 
> Cc: [email protected]
> Assisted-by: gkh_clanker_t1000
> Signed-off-by: Griffin Kroah-Hartman <[email protected]>
> ---
>  drivers/usb/misc/usbio.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
> index 3c2474dca810..794322ff09fd 100644
> --- a/drivers/usb/misc/usbio.c
> +++ b/drivers/usb/misc/usbio.c
> @@ -341,6 +341,9 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
>  	if (bpkt->header.flags & USBIO_PKTFLAG_ERR)
>  		return -EREMOTEIO;
>  
> +	if (bpkt_len > act - sizeof(*bpkt))
> +		return -EPROTO;
> +

Isn't this just a repeat of the code sitting 4 lines below?

Alan Stern

>  	if (ibuf_len < bpkt_len)
>  		return -ENOSPC;
>  
> 
> ---
> base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
> change-id: 20260806-usb_drivers_usbio-55ac8cc2e572
> 
> Best regards,
> --  
> Griffin Kroah-Hartman <[email protected]>