usbip: validate ISO packet descriptors and URB lengths in vhci, vudc, and usbip_common

[PATCH] usbip: validate ISO packet descriptors and URB lengths in vhci, vudc, and usbip_common

Posted by Hui Peng 4 days, 22 hours ago

In drivers/usb/usbip/ (usbip_common.c, vhci_rx.c, vudc_dev.c), validate
actual_length, number_of_packets, and isochronous packet descriptor
offsets against the transfer buffer capacity before copying payload
data.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
index 100f8920624b..8bd9af7ebfc8 100644
--- a/drivers/usb/usbip/usbip_common.c
+++ b/drivers/usb/usbip/usbip_common.c
@@ -482,7 +482,6 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
 		if (rpdu->number_of_packets < 0 ||
 		    rpdu->number_of_packets > urb->number_of_packets)
 			rpdu->number_of_packets = 0;
-		urb->number_of_packets = rpdu->number_of_packets;
 		urb->error_count	= rpdu->error_count;
 	}
 }
@@ -702,8 +701,9 @@ int usbip_recv_iso(struct usbip_device *ud, struct urb *urb)
 
 	ret = usbip_recv(ud->tcp_socket, buff, size);
 	if (ret != size) {
-		dev_err(&urb->dev->dev, "recv iso_frame_descriptor, %d\n",
-			ret);
+		if (urb->dev)
+			dev_err(&urb->dev->dev,
+				"recv iso_frame_descriptor, %d\n", ret);
 		kfree(buff);
 
 		if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC)
@@ -781,6 +781,8 @@ void usbip_pad_iso(struct usbip_device *ud, struct urb *urb)
 	 * memory when padding) and move them into the proper place
 	 */
 	for (i = np-1; i > 0; i--) {
+		if (actualoffset < urb->iso_frame_desc[i].actual_length)
+			return;
 		actualoffset -= urb->iso_frame_desc[i].actual_length;
 
 		/*
diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
index a678e7c89837..7ef646095408 100644
--- a/drivers/usb/usbip/vhci_rx.c
+++ b/drivers/usb/usbip/vhci_rx.c
@@ -73,6 +73,13 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
 		return;
 	}
 
+	if (usb_pipeisoc(urb->pipe) &&
+	    pdu->u.ret_submit.number_of_packets != urb->number_of_packets) {
+		usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+		urb->status = -EPROTO;
+		goto error;
+	}
+
 	/* unpack the pdu to a urb */
 	usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0);

Re: [PATCH] usbip: validate ISO packet descriptors and URB lengths in vhci, vudc, and usbip_common

Posted by Greg KH 4 days, 15 hours ago

On Sat, Sep 19, 2026 at 10:35:19PM +0000, Hui Peng wrote:
> In drivers/usb/usbip/ (usbip_common.c, vhci_rx.c, vudc_dev.c), validate
> actual_length, number_of_packets, and isochronous packet descriptor
> offsets against the transfer buffer capacity before copying payload
> data.

Why?

> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Assisted-by: LLM

I think your LLM didn't read the email archives well for this driver...

> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
> index 100f8920624b..8bd9af7ebfc8 100644
> --- a/drivers/usb/usbip/usbip_common.c
> +++ b/drivers/usb/usbip/usbip_common.c
> @@ -482,7 +482,6 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
>  		if (rpdu->number_of_packets < 0 ||
>  		    rpdu->number_of_packets > urb->number_of_packets)
>  			rpdu->number_of_packets = 0;
> -		urb->number_of_packets = rpdu->number_of_packets;

You are removing this, why?

How was this tested?

greg k-h

Re: [PATCH] usbip: validate ISO packet descriptors and URB lengths in vhci, vudc, and usbip_common

Posted by Hui Peng 3 days, 18 hours ago

On Sun, Sep 20, 2026 at 6:18 AM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> > diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
> > index 100f8920624b..8bd9af7ebfc8 100644
> > --- a/drivers/usb/usbip/usbip_common.c
> > +++ b/drivers/usb/usbip/usbip_common.c
> > @@ -482,7 +482,6 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
> >               if (rpdu->number_of_packets < 0 ||
> >                   rpdu->number_of_packets > urb->number_of_packets)
> >                       rpdu->number_of_packets = 0;
> > -             urb->number_of_packets = rpdu->number_of_packets;
>
> You are removing this, why?
>
> How was this tested?
>
> greg k-h

Apologies for the noise, Greg.

We originally found and tested these ISO packet descriptor issues on
6.18.14, and when rebasing onto mainline we missed that commits
2ab833a16a82 ("usbip: validate number_of_packets in
usbip_pack_ret_submit()") and 4f8d24c48101 ("usb: usbip: validate source
and destination offsets in usbip_pad_iso()") had already fixed them in
upstream, which caused the rebase conflict in usbip_pack_ret_submit().

Please drop this patch.

Best regards,
Hui Peng