A successful interrupt URB completion can still carry fewer bytes than the
two-byte report consumed by appledisplay_complete(). The callback
unconditionally reads urbdata[1].

Resubmit short successful reports without parsing them.

Fixes: 069e8a65cd79 ("[PATCH] Driver for Apple Cinema Display")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/usb/misc/appledisplay.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index 16883592f7fc6..4543545793e27 100644
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -82,6 +82,8 @@ static void appledisplay_complete(struct urb *urb)
 	switch (status) {
 	case 0:
 		/* success */
+		if (urb->actual_length < ACD_URB_BUFFER_LEN)
+			goto exit;
 		break;
 	case -EOVERFLOW:
 		dev_err(dev,

base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
-- 
2.50.1

On Sun, Aug 30, 2026 at 10:24:06PM +0800, Pengpeng Hou wrote:
> A successful interrupt URB completion can still carry fewer bytes than the
> two-byte report consumed by appledisplay_complete(). The callback
> unconditionally reads urbdata[1].
> 
> Resubmit short successful reports without parsing them.
> 
> Fixes: 069e8a65cd79 ("[PATCH] Driver for Apple Cinema Display")
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/usb/misc/appledisplay.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
> index 16883592f7fc6..4543545793e27 100644
> --- a/drivers/usb/misc/appledisplay.c
> +++ b/drivers/usb/misc/appledisplay.c
> @@ -82,6 +82,8 @@ static void appledisplay_complete(struct urb *urb)
>  	switch (status) {
>  	case 0:
>  		/* success */
> +		if (urb->actual_length < ACD_URB_BUFFER_LEN)
> +			goto exit;

This should go above the comment, right?

thanks,

greg k-h