Re: [PATCH v2] usb: usbtmc: reject invalid interrupt endpoints

[Heitor Alves de Siqueira]

On Tue Apr 28, 2026 at 7:16 PM -03, Michal Pecio wrote:
> I'm completely unfamiliar with this class, but my understanding of
> USBTMC spec is that bNotify1 is mandatory while bNotify2 may have
> any length, likely including zero, though it's a bit imprecise.
>
> The driver only supports notifications defined in the separate USB488
> spec and for these, bNotify2 should be one byte. It also warns on
> every unrecognized notification.
>
> I think a minimal fix which mostly preserves existing behavior would
> be adding "urb->actual_length == 2" as a requirement for all USB488
> notifications. Then any truncated message will be ignored and logged.

Yes, that's my understanding as well! Although I don't think bNotify2
would ever be zero in practice, this sounds like a good approach. I'll
submit a v3 with this change plus the endpoint check from v2, hopefully
that'll improve things for these edge cases.

> wMaxPacketSize is a separate issue indeed and it seems that a USB488
> device could legally set it to 1, though it would be crazy. Your v1
> patch would probably make such devices work, if anyone cares.

Honestly, I'm also more inclined to just reject endpoints with this
configuration. This seems like a very niche edge-case, I'd be surprised
if real hardware operated like this (famous last words? heh). I'm not
sure if this would even be valid/legal, given your previous point on
bNotify2 being one byte. Considering these devices do not work at all
currently, checking if wMaxPacketSize and urb->actual_length are big
enough seems like a saner approach and won't require bigger changes to
the driver.

Thanks for the help, Michal!

Best regards,
Heitor