Re: [PATCH] usbip: Reject unterminated strings received from peers

[Shuah Khan]

On 9/3/26 04:05, Mark Amirkan via B4 Relay wrote:
> From: Mark Amirkan <markdamirkan@xxxxxxxxx>
>
> USB/IP path and busid fields are fixed-size strings and must contain a NUL
> byte. The list and attach clients and usbipd use fields received from a
> peer as C strings without checking them first.
>
> A reply with an unterminated field makes both clients read past the end of
> the 312-byte device record. ASan reports a stack-buffer overflow at the end
> of the record in both paths. In ten normal attach runs, the busid error
> printed six bytes beyond the received record. The server did not send those
> bytes, and their values changed between processes.
>
> An import request with no NUL in its 32-byte busid makes usbipd read past
> the request too. ASan reports the access at the end of the request.
>
> Check the strings after receiving them and reject messages without the
> required NUL byte.

How do you reproduce this problem? Can you elaborate on the setup you
used to reproduce and test the fix?

thanks,
-- Shuah