From nobody Sat Jul 25 18:53:26 2026 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 814F53CF207 for ; Tue, 14 Jul 2026 18:11:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784052709; cv=none; b=gd+zxjx1fF77EJMXnnyD1IbNrQA8L4M7w+PHcxmFLOs3vC4rQiKDkBsESWKYF3YM072UQ88K0SsieSaSUDWj/4G1BOECQ/RqE+OiIa2+tqBC2osMoJW6BR30MN9Rw/XMLey9iBB+SAheUE7zP4UZ5xxMeQ4/ZbJELMRbXbwGAo0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784052709; c=relaxed/simple; bh=hBsP5eEDHNHagwaJe9v18Ny2Nwb2L1p/CxMZ7iJOKHQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=i0FNkwm/fqqPFizkHT516XVvkpEoZufJyWJtGr/oYVc50HBHdmSUC1rrILQq4X4b9v9krkDdgtfQR9j7hEuMgOEMeWljIJEm5Mq9nMtj48HLj6OhCfmeHreKgAsYXFGiqhMzKzUSRYkkqPoQik0c51GPRsGMbMdo/AYfKydE8q4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XtCFLlhN; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XtCFLlhN" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-381b831d535so1471115a91.0 for ; Tue, 14 Jul 2026 11:11:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784052708; x=1784657508; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SRXfPs9aJXVj7efeegqyZcry94icAjp1/Aq1dXdDufk=; b=XtCFLlhNJaxLgrqIWjkZsJSg6Mwqc5pYdVeqLpJwzjyF4BZMuTacLHH2SWoSQhfabJ rsGI6u1fEtWRBpYNL9xhd60+IEl17PUYDCG9CmJg/0lWW/9ltgra9TfHWYjQ3eoH0d6p XLMIPNwfbUSxK9Tz+hrMJU/lmO4SLmhMYL4RDSlTx7M4ifMY3oA+aAy3shclSyz2mh9G o3u2wSCV0bfr5pun09UrBwDhVwGRUFCH8KVLcAp5FH4p8rKHoyTf0U3bDM/3EoAuBlsZ RSnExGQJtS8jMtYYP9XxrZMPTwSCaKs6FSV05AL2bY+myPTuGLQnwn+HG/olC74uqRI3 yjKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784052708; x=1784657508; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=SRXfPs9aJXVj7efeegqyZcry94icAjp1/Aq1dXdDufk=; b=oMUujUDNSfX3nx4v5RE79yI2KU4wt7KJwTvJP7tKTYgF0y+DOitQ2awqIHxPFTso1y ArFk4cI3Q3CdlUb6cQLQzcYsSnE7hrThu0CNA/m740L6B+MxSEeBbU22QQgS+uhc3SAa y1ZTci6lEMGmHshZ22z92p2+vI5DMZcFxaRQNtEuy6RB7mSInKRWSMwrFA6h9nYcmxls MV+tpRQriyCS2VujOib2al6YmBep1mwZQNgNbjYRq3AprxNVThkJszlW4OpuPPIel+ev VGzfMYcJVnVBjzFsaeHFB8KbBXHJ6L1KtRm29wUcMFxw3uxju66FbvO0mRa0bYedWO4g ZUOQ== X-Forwarded-Encrypted: i=1; AHgh+RoOkYFG++1aXBEHskRDvxltEmunj6NfK7uspfHQS4rcM6BZjMa4GqsCdWkMm9uDVQ+HntSrOe3dVBgsc1w=@vger.kernel.org X-Gm-Message-State: AOJu0YzPO2TJZd8XwLpLNWCZ+JCTwEGgdi9m3cfrApOFVMmHY8pECYHm 7pND0HtyXHzWxW/DavnaCrDY/p+ZVoUW2R7sw3a1WtLcRNI8WPoioM9F X-Gm-Gg: AfdE7cnEP9rXy7MOdxRaXQ2+CWZiyGStQoFOC53zQEvhbtigVXeMdze/TwbngFJLxn1 QzzzssIGXO5ffJk/ww3RX3xhhWFzz3wEj1OA6Va40McDvvjxRMpnhRyALHKe56fmGdHuP1KxJR8 fQStIImeec4Db+0O0RH/HgcHxk2gWOll5w+af1qs7ogKGqhska+Xuw2hWEXfO1rTfXiArfTngY1 to11wPEPY+fdgf3/sDK4QZzdE6bg3WZhbF413lF0tYy+9yeP0kEAH/QydzKYI5gVGzLwo9lW8x2 WsbzxgjIsm8PEsD/qvsLOJGaSqeYWVF8CtDlPcGS/Rohp0TapynTWtA1fdUFm8pAb/dDXx78syA 3hZZ9rqKR+JzSnUNNJAelvuglxaxpJ/UoyHpVPOr5Y8QHLhi/PG1UmHYMwp1MbxZenMQd7tBsUD O92HOcm/+JwqPMYNyz X-Received: by 2002:a17:90b:4990:b0:366:52fe:e749 with SMTP id 98e67ed59e1d1-38dc73beb6dmr14747011a91.5.1784052707688; Tue, 14 Jul 2026 11:11:47 -0700 (PDT) Received: from nixos ([2001:579:62a8:47:3869:b665:31a3:e072]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3118ee6080dsm62416288eec.17.2026.07.14.11.11.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 11:11:47 -0700 (PDT) From: Jay Vadayath To: gregkh@linuxfoundation.org, johan@kernel.org Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Jay Vadayath , stable@vger.kernel.org, Lukas Dresel Subject: [PATCH] USB: serial: sierra: fix slab out-of-bounds read in sierra_instat_callback Date: Tue, 14 Jul 2026 11:11:42 -0700 Message-ID: <20260714181142.10976-1-jkrshnmenon@gmail.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The interrupt-in URB buffer is allocated based on the endpoint's wMaxPacketSize. A device declaring wMaxPacketSize =3D=3D 8 gets an 8-byte buffer from kmalloc-8. When such a device delivers a short packet, sierra_instat_callback() still dereferences transfer_buffer as struct usb_ctrlrequest and reads a further byte at data[sizeof(*req_pkt)], one byte past the end of the allocation. Reject the URB when fewer than sizeof(struct usb_ctrlrequest) + 1 bytes were received. Cc: stable@vger.kernel.org Reported-by: Jay Vadayath Reported-by: Lukas Dresel Signed-off-by: Jay Vadayath --- Apologies for the wall of text in the original mail. I wanted to include the artifacts inline so the bug could be independently verified. Just the patch this time. Same shape of fix as Jiale Yao's option.c patch: https://lore.kernel.org/all/20260712170012.3503601-1-yaojiale02@163.com/ Tested with the reproducer against v7.2-rc3. The KASAN splat does not appear with the patch applied. drivers/usb/serial/sierra.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c index 6e443aacae07..4c6e7120695e 100644 --- a/drivers/usb/serial/sierra.c +++ b/drivers/usb/serial/sierra.c @@ -575,6 +575,13 @@ static void sierra_instat_callback(struct urb *urb) __func__); return; } + + if (urb->actual_length < sizeof(struct usb_ctrlrequest) + 1) { + dev_dbg(&port->dev, "%s: short interrupt transfer: %d bytes\n", + __func__, urb->actual_length); + return; + } + if ((req_pkt->bRequestType =3D=3D 0xA1) && (req_pkt->bRequest =3D=3D 0x20)) { int old_dcd_state; -- 2.51.2