Re: [PATCH] usbip: validate ISO packet descriptors and URB lengths in vhci, vudc, and usbip_common

[Greg KH]

On Sat, Sep 19, 2026 at 10:35:19PM +0000, Hui Peng wrote:
> In drivers/usb/usbip/ (usbip_common.c, vhci_rx.c, vudc_dev.c), validate
> actual_length, number_of_packets, and isochronous packet descriptor
> offsets against the transfer buffer capacity before copying payload
> data.

Why?

> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Assisted-by: LLM

I think your LLM didn't read the email archives well for this driver...

> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> ---
> diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
> index 100f8920624b..8bd9af7ebfc8 100644
> --- a/drivers/usb/usbip/usbip_common.c
> +++ b/drivers/usb/usbip/usbip_common.c
> @@ -482,7 +482,6 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
>  		if (rpdu->number_of_packets < 0 ||
>  		    rpdu->number_of_packets > urb->number_of_packets)
>  			rpdu->number_of_packets = 0;
> -		urb->number_of_packets = rpdu->number_of_packets;

You are removing this, why?

How was this tested?

greg k-h