[PATCH] USB: serial: sierra: fix slab out-of-bounds read in sierra_instat_callback

[Jay Vadayath]

The interrupt-in URB buffer is allocated based on the endpoint's
wMaxPacketSize. A device declaring wMaxPacketSize == 8 gets an 8-byte
buffer from kmalloc-8. When such a device delivers a short packet,
sierra_instat_callback() still dereferences transfer_buffer as struct
usb_ctrlrequest and reads a further byte at data[sizeof(*req_pkt)], one
byte past the end of the allocation.

Reject the URB when fewer than sizeof(struct usb_ctrlrequest) + 1 bytes
were received.

Cc: stable@xxxxxxxxxxxxxxx
Reported-by: Jay Vadayath <jkrshnmenon@xxxxxxxxx>
Reported-by: Lukas Dresel <lukas@xxxxxxxxxxxxxxxx>
Signed-off-by: Jay Vadayath <jkrshnmenon@xxxxxxxxx>
---
Apologies for the wall of text in the original mail. I wanted to include
the artifacts inline so the bug could be independently verified. Just the
patch this time.

Same shape of fix as Jiale Yao's option.c patch:
https://lore.kernel.org/all/20260712170012.3503601-1-yaojiale02@xxxxxxx/

Tested with the reproducer against v7.2-rc3. The KASAN splat does not
appear with the patch applied.

 drivers/usb/serial/sierra.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 6e443aacae07..4c6e7120695e 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -575,6 +575,13 @@ static void sierra_instat_callback(struct urb *urb)
 				__func__);
 			return;
 		}
+
+		if (urb->actual_length < sizeof(struct usb_ctrlrequest) + 1) {
+			dev_dbg(&port->dev, "%s: short interrupt transfer: %d bytes\n",
+				__func__, urb->actual_length);
+			return;
+		}
+
 		if ((req_pkt->bRequestType == 0xA1) &&
 				(req_pkt->bRequest == 0x20)) {
 			int old_dcd_state;
--
2.51.2