From: zjzhao-eda <zjzhao@edatec.cn>

number_of_packets is only meaningful for isochronous URBs.  The USB/IP
stub currently copies the value from the CMD_SUBMIT PDU into the local
URB verbatim for all endpoint types.

Some clients (e.g. usbip-win) leave number_of_packets uninitialized for
non-isoc URBs, so a garbage/huge value reaches usb_submit_urb().  Host
controllers that size per-URB allocations by this field (e.g. dwc2's
dwc2_hcd_urb_alloc(), which always sizes the iso descriptor array by
urb->number_of_packets) then attempt a multi-gigabyte allocation that
fails with -ENOMEM, making usbip-host reset the device in an endless
loop (older dwc_otg crashes outright instead).

Sanitize number_of_packets to 0 for non-isochronous endpoints in the
stub.  This is a strict no-op for well-behaved clients (Linux vhci
already sends 0 for non-isoc URBs) and fixes the dwc2/dwc_otg failures.

Signed-off-by: zjzhao-eda <zjzhao@edatec.cn>
---
 drivers/usb/usbip/stub_rx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 1e9ae578810d..ec9ecbf432f5 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -481,6 +481,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
 
 	if (pipe == -1)
 		return;
+	if (!usb_pipeisoc(pipe))
+		pdu->u.cmd_submit.number_of_packets = 0;
 
 	/*
 	 * Smatch reported the error case where use_sg is true and buf_len is 0.
-- 
2.43.0

On 8/24/26 21:36, zjzhao@edatec.cn wrote:
> From: zjzhao-eda <zjzhao@edatec.cn>
> 
> number_of_packets is only meaningful for isochronous URBs.  The USB/IP
> stub currently copies the value from the CMD_SUBMIT PDU into the local
> URB verbatim for all endpoint types.
> 
> Some clients (e.g. usbip-win) leave number_of_packets uninitialized for

Using usbip-win isn't a supported configuration.

> non-isoc URBs, so a garbage/huge value reaches usb_submit_urb().  Host
> controllers that size per-URB allocations by this field (e.g. dwc2's
> dwc2_hcd_urb_alloc(), which always sizes the iso descriptor array by
> urb->number_of_packets) then attempt a multi-gigabyte allocation that
> fails with -ENOMEM, making usbip-host reset the device in an endless
> loop (older dwc_otg crashes outright instead).
> 
> Sanitize number_of_packets to 0 for non-isochronous endpoints in the
> stub.  This is a strict no-op for well-behaved clients (Linux vhci
> already sends 0 for non-isoc URBs) and fixes the dwc2/dwc_otg failures.

Also how does this manifest? Where in the code path do we use the
number_of_packets without checking the usb_pipeisoc type first?

> Signed-off-by: zjzhao-eda <zjzhao@edatec.cn>
> ---
>   drivers/usb/usbip/stub_rx.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
> index 1e9ae578810d..ec9ecbf432f5 100644
> --- a/drivers/usb/usbip/stub_rx.c
> +++ b/drivers/usb/usbip/stub_rx.c
> @@ -481,6 +481,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
>   
>   	if (pipe == -1)
>   		return;
> +	if (!usb_pipeisoc(pipe))
> +		pdu->u.cmd_submit.number_of_packets = 0;
>   
>   	/*
>   	 * Smatch reported the error case where use_sg is true and buf_len is 0.

thanks,
-- Shuah

Hi Shuah, all,

Pinging this patch from a couple of weeks ago in case it got lost in
the merge-window noise.

    [PATCH] usbip: host: ignore number_of_packets for non-isoc URBs
    <20260825033623.332537-1-zjzhao@edatec.cn>

It sanitizes number_of_packets to 0 for non-isochronous endpoints in
the stub, which fixes an -ENOMEM/reset-loop failure with usbip-win
clients on dwc2/dwc_otg hosts. The change is a strict no-op for
well-behaved clients (Linux vhci already sends 0), and it complements
the existing number_of_packets validation added by c6688ef9f297.

Would you like me to rebase/resend, or is there anything I should
adjust? Happy to make any changes.

Thanks for your time and for maintaining usbip.

-- 
zjzhao-eda
EDATEC Technology Co., Ltd.