From nobody Mon May 25 02:41:54 2026 Received: from mail-pl1-f195.google.com (mail-pl1-f195.google.com [209.85.214.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D658351C30 for ; Tue, 19 May 2026 11:12:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779189125; cv=none; b=ibRnsIV7dONUF28Q6fL/0is1ZnHe4ELVEZeFSv55Ub0d2tfzuIaQA3Jt+WVfrNlonvWCMa60RSRWZjbR8u0sHIuegV68LJZ6QFrm0kPaRvtzDG2F+Qy6lXFwX9Il6d5dtVx9J+/+1Kv1iPIXiafwo+pixtN4IGVhWab7/IuYCBw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779189125; c=relaxed/simple; bh=5iSgd3tv+dVvOUKz65tylGgonMmJAdjSoAG/9e1p/OE=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=GEpkLbaXs5Kse9ZOCNlMIks6dJEReMH0RIy4tl0qs1b2IQaI95gWmmZ9PlMhOWzoTxbdSecX2Plvd9zfZpER8TBjMNKmlw+y3RwYTvTHj45yBMk6hSUaDoZ332dya86RdfAXsAmu79NpOc5ImnbKy7HlcwRJldHtdiBEZtn2baI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ip5jYDrI; arc=none smtp.client-ip=209.85.214.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ip5jYDrI" Received: by mail-pl1-f195.google.com with SMTP id d9443c01a7336-2bd9c3b550aso22514435ad.2 for ; Tue, 19 May 2026 04:12:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779189123; x=1779793923; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=2IFAcx0DbZumq9/olV6xC3aeSPRYxGST6sCT2oqEP/g=; b=ip5jYDrIjjodJ2WsMCPmVWDfN8ywlRTPEb/od6u9k3weeFdtWlo7DYZ+ANFH5Fc0+Z n5XAEQnSk082lQyG/LFZ7ipYO/IhiDsu09onB9jHk2fRkZ6opKe/PbByWmreeR81wBXn ActKB6f8yMCd7IJhhOxSSlLF/qKflzEbq78tn98eY0/qPiNB2soKgc0/BBTBp03gcybO sTi7BjvWBZmZq0ZvW2pMx+4bl5UkqJ2NgDP/TvZ0rVNHaQRiSIa0KC6Xc1cD4xvYdBPR ZCMJBW82YQ6a6J1tnRQeefwwBFk/Uv9BrD5/qL/fnMK9aP2GiVe+DZx/PlOmQQ++N7XV 0LQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779189123; x=1779793923; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=2IFAcx0DbZumq9/olV6xC3aeSPRYxGST6sCT2oqEP/g=; b=XlRBwCOJLPdg7FGAx1t036F1aAT7a1vVoGIV3s11cFDAR8cSB7S2yhgTGc9kB3EOME jOVCIuEkSGZaNyylZCzxoEtQCz+rdXoi0eS79K+IMJcDai8C9wglJYBkLQXnqj/29mA9 thQ/cMWQkfsyT3zKX1rJzcS3NbFfqKz4P8kf2bHVhWMhzKMWLVEQ3B0UdBzBpe2JxLs6 uNKYJHcuoLhGVLdSWIxewz4H6TGCiPNGj+/0CRy2EOIT8uZ1OqAl3MGiieAJ9Zrbxyjo Q9h39pMSVf5VHwYm4mDnUHd/0kQfwOGANXQEDkWeSywbNNWvzJCqmgLpoe4ZCOEplhKP /rKQ== X-Forwarded-Encrypted: i=1; AFNElJ+0gsAatJ3wHymzpDgnS6a+rmcNNHenAoVe+7m17/8rcupqpmiFCUlqbS1NjuasTCwodu0n6XEmu5AiKKM=@vger.kernel.org X-Gm-Message-State: AOJu0YwgQ7JD89AmWMOGVR0l6j9OGwuu3vfarI+6JYFfZ9EL1ryhxgSp B7GdwVmQnHdBDGkQM3vd2Q5Vixb2IK4UyJtoH1Hfa2Fhxro/xP4iW5yj X-Gm-Gg: Acq92OH624fVhEevqoB/J9Gixaq+HJR2UvHP70lxHPQmP5INy9oE2KWuTPSelPBp3Lv AXIaXnv8kx1JOOryibesY6n38bjRrkJ8wEpv8k3hyYnzErB2QchNrCNhR2aLFYomMwbdY1CavBM vaHqjv3B8AtB77LItvr5EBaaqwiJGle94f86jqwkoaQJarfaNzkAcyNfm1med+6PGbi+VAotN33 AEQImFOfjnwc5NYC+UOLAOKWiGj2uONq/aTKTOqmCK/qIOZpSxygvqLTh5UFPByM2XmqOez7Caz SffhWoOvbuZ+OrLQTaSIkz3rHaI0fFHPkRHR65zfv/+0khz/C92g9g6lcNXKjDvkde2sUzbR7mi pdBbD9LnOVGpeJ8qKHadhBvIvlLqIFYX1U6BsYmZiII1g/QmU4WwM/rVNLUKJ71ljt+Q7hc7VQR GbZIoLij+KxM32m5uUICQQInve67x5zg30CMiGx8sxlQ== X-Received: by 2002:a17:903:1b4e:b0:2b0:c59f:3b58 with SMTP id d9443c01a7336-2bd7e7b58a8mr207656095ad.9.1779189123474; Tue, 19 May 2026 04:12:03 -0700 (PDT) Received: from localhost ([111.228.63.84]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bd5d0f94c6sm186505855ad.56.2026.05.19.04.11.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 May 2026 04:12:02 -0700 (PDT) From: Zhang Cen To: Johan Hovold , Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, zerocling0077@gmail.com, 2045gemini@gmail.com, Zhang Cen Subject: [PATCH v2] USB: serial: belkin_sa: validate interrupt status length Date: Tue, 19 May 2026 19:11:50 +0800 Message-Id: <20260519111150.3583363-1-rollkingzzc@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from endpoint wMaxPacketSize, and short interrupt transfers may complete successfully with a smaller actual_length. Check the completed interrupt packet length before parsing status fields so short interrupt endpoints and short successful packets are ignored instead of causing out-of-bounds or stale status-byte reads. KASAN report as below: BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback() Read of size 1 Call trace: belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202) __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630) dummy_timer() (?:?) __hrtimer_run_queues() (kernel/time/hrtimer.c:1968) hrtimer_run_softirq() (kernel/time/hrtimer.c:2001) handle_softirqs() (kernel/softirq.c:579) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: Codex:gpt-5.5 Signed-off-by: Zhang Cen --- v2: - Drop the transfer_buffer_length check; urb->actual_length is bounded by the URB transfer buffer length. - Add the KASAN validation report. - Add Assisted-by tag. drivers/usb/serial/belkin_sa.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/serial/belkin_sa.c b/drivers/usb/serial/belkin_sa.c index 38ac910b1082d..1e0d9041969b3 100644 --- a/drivers/usb/serial/belkin_sa.c +++ b/drivers/usb/serial/belkin_sa.c @@ -193,6 +193,8 @@ static void belkin_sa_read_int_callback(struct urb *urb) } =20 usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data); + if (urb->actual_length < BELKIN_SA_MSR_INDEX + 1) + goto exit; =20 /* Handle known interrupt data */ /* ignore data[0] and data[1] */ --=20 2.43.0