Re: [PATCH 1/2] usbip: clear actual_length after a failed receive

[Cheng Yongkang]

Hi Shuah, Sung,

My patch 1/2 makes the same change as Sung's earlier submission:

https://lore.kernel.org/linux-usb/20261009122636.642575-1-tjdqudcks0424@xxxxxxxxx/

Please drop mine; sorry for the duplicate. My explanation above of why
-EPROTO alone does not stop the usbfs copy applies to Sung's patch as
well.

That change does not cover the high-bit length case raised in the
review of Sung's patch:

https://lore.kernel.org/linux-usb/sashiko-outbox-165560@xxxxxxxxxx/

I have only checked this in the source: usbip_recv_xbuff() stores the
length in an int, so a value with the top bit set takes the size <= 0
early return, and the URB is given back with that length.

I have sent the usbfs side separately. It bounds actual_length in
usbfs regardless of what the HCD reports:

https://lore.kernel.org/linux-usb/20261101070651.1846947-1-teel4res@xxxxxxxxx/

Thanks,
Cheng Yongkang