Re: [PATCH] usb: appledisplay: validate interrupt report length

[Greg Kroah-Hartman]

On Sun, Aug 30, 2026 at 10:24:06PM +0800, Pengpeng Hou wrote:
> A successful interrupt URB completion can still carry fewer bytes than the
> two-byte report consumed by appledisplay_complete(). The callback
> unconditionally reads urbdata[1].
> 
> Resubmit short successful reports without parsing them.
> 
> Fixes: 069e8a65cd79 ("[PATCH] Driver for Apple Cinema Display")
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
>  drivers/usb/misc/appledisplay.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
> index 16883592f7fc6..4543545793e27 100644
> --- a/drivers/usb/misc/appledisplay.c
> +++ b/drivers/usb/misc/appledisplay.c
> @@ -82,6 +82,8 @@ static void appledisplay_complete(struct urb *urb)
>  	switch (status) {
>  	case 0:
>  		/* success */
> +		if (urb->actual_length < ACD_URB_BUFFER_LEN)
> +			goto exit;

This should go above the comment, right?

thanks,

greg k-h