[PATCH] usb: misc: usbio: fix bulk receive overread

[Griffin Kroah-Hartman]

Add a check for bpkt_len being more than what was actually sent from the
device in usbio_bulk_msg().

A malicious device could use this vulnerability to claim that more data
was sent, when in reality it was not, leading to an OOB read later on
with the memcpy at the end of the function.

Cc: stable@xxxxxxxxxx
Assisted-by: gkh_clanker_t1000
Signed-off-by: Griffin Kroah-Hartman <griffin@xxxxxxxxx>
---
 drivers/usb/misc/usbio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
index 3c2474dca810..794322ff09fd 100644
--- a/drivers/usb/misc/usbio.c
+++ b/drivers/usb/misc/usbio.c
@@ -341,6 +341,9 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
 	if (bpkt->header.flags & USBIO_PKTFLAG_ERR)
 		return -EREMOTEIO;
 
+	if (bpkt_len > act - sizeof(*bpkt))
+		return -EPROTO;
+
 	if (ibuf_len < bpkt_len)
 		return -ENOSPC;
 

---
base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
change-id: 20260806-usb_drivers_usbio-55ac8cc2e572

Best regards,
--  
Griffin Kroah-Hartman <griffin@xxxxxxxxx>