Re: [PATCH] usbip: validate ISO packet descriptors and URB lengths in vhci, vudc, and usbip_common

[Hui Peng]

On Sun, Sep 20, 2026 at 6:18 AM Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> > diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
> > index 100f8920624b..8bd9af7ebfc8 100644
> > --- a/drivers/usb/usbip/usbip_common.c
> > +++ b/drivers/usb/usbip/usbip_common.c
> > @@ -482,7 +482,6 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
> >               if (rpdu->number_of_packets < 0 ||
> >                   rpdu->number_of_packets > urb->number_of_packets)
> >                       rpdu->number_of_packets = 0;
> > -             urb->number_of_packets = rpdu->number_of_packets;
>
> You are removing this, why?
>
> How was this tested?
>
> greg k-h

Apologies for the noise, Greg.

We originally found and tested these ISO packet descriptor issues on
6.18.14, and when rebasing onto mainline we missed that commits
2ab833a16a82 ("usbip: validate number_of_packets in
usbip_pack_ret_submit()") and 4f8d24c48101 ("usb: usbip: validate source
and destination offsets in usbip_pad_iso()") had already fixed them in
upstream, which caused the rebase conflict in usbip_pack_ret_submit().

Please drop this patch.

Best regards,
Hui Peng