Re: [PATCH v2] usb: usbfs: clamp actual_length to transfer_buffer_length

[Greg Kroah-Hartman]

On Sun, Nov 01, 2026 at 12:06:51AM -0700, Cheng Yongkang wrote:
> usbfs uses urb->actual_length from the host controller driver without
> checking it against the buffer it allocated. For a completed
> non-isochronous IN URB, processcompl() and processcompl_compat() copy
> that many bytes to userspace and report the same value, and
> async_completed() passes it to snoop_urb_data() when usbfs_snoop is
> enabled.
> 
> With USB/IP, the value comes from the remote peer. If the peer returns
> actual_length=88 for a 24-byte control-IN transfer, usbip_recv_xbuff()
> rejects the length, but VHCI still gives back the URB with -EPROTO and
> actual_length=88. usbfs copies data from failed URBs too, since they
> can carry valid partial data, so reaping the URB reads past the buffer:
> 
>   BUG: KASAN: slab-out-of-bounds in _copy_to_user
>    copy_urb_data_to_user
> 
> With usbfs_snoop enabled, hex_dump_to_buffer() reads past the buffer
> earlier, when the URB completes.

Why not fix this properly in usbip so that all drivers don't have to do
this type of check as well?  That's where the "bug" is, if any.

thanks,

greg k-h