[PATCH] usb: core: devio: add defensive bounds check for len2 in do_proc_bulk()
From: rivaldihormat-debug
Date: Fri Sep 04 2026 - 02:41:26 EST
Although the USB host controller hardware prevents len2 from exceeding
len1 in normal operation via babble error handling, add an explicit
kernel-side check to improve robustness. This helps prevent unexpected
behavior in virtualized environments where emulation bugs might break
this guarantee.
Clamp len2 to len1 if it exceeds the allocated buffer size and log
a warning message.
Signed-off-by: rivaldihormat-debug <rivaldihormat@xxxxxxxxxxx>
---
drivers/usb/core/devio.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 101cb9425480..9d8930853e8f 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1343,6 +1343,10 @@ static int do_proc_bulk(struct usb_dev_state *ps,
snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
if (!i && len2) {
+ if (len2 > len1) {
+ dev_warn(&dev->dev, "USB returned more data than expected\n");
+ len2 = len1;
+ }
if (copy_to_user(bulk->data, tbuf, len2)) {
ret = -EFAULT;
goto done;
--
2.53.0