Re: [PATCH v2] usb: usbfs: clamp actual_length to transfer_buffer_length

[Cheng Yongkang]

Hi Greg,

Agreed, that is where the bug is, so please drop this patch.

That was in fact the first fix: patch 1/2 of my original series cleared
actual_length in vhci when usbip_recv_xbuff() fails:

https://lore.kernel.org/linux-usb/179328314074.648427.388274461758949120@xxxxxxxxx/

I withdrew it only because Sung Byeongchan had posted the same one-liner
three weeks earlier:

https://lore.kernel.org/linux-usb/20261009122636.642575-1-tjdqudcks0424@xxxxxxxxx/

That patch has been waiting since, with an open question from Shuah.
Its review had also already pointed out the case it misses: a returned
length with the top bit set is read into an int in usbip_recv_xbuff(),
takes the size <= 0 early return, and the URB is given back with that
length anyway:

https://lore.kernel.org/linux-usb/sashiko-outbox-165560@xxxxxxxxxx/

Rejecting any actual_length larger than transfer_buffer_length in
vhci_recv_ret_submit() covers both. I can send that, or Sung can fold
it into his patch, whichever you and Shuah prefer.

Thanks,
Cheng Yongkang