[PATCH v2] USB: serial: belkin_sa: validate interrupt status length

[PATCH v2] USB: serial: belkin_sa: validate interrupt status length

[Zhang Cen]

The Belkin interrupt callback treats interrupt data as a four-byte
status report and reads LSR/MSR fields at offsets 2 and 3. The
interrupt-in buffer length is derived from endpoint wMaxPacketSize, and
short interrupt transfers may complete successfully with a smaller
actual_length.

Check the completed interrupt packet length before parsing status
fields so short interrupt endpoints and short successful packets are
ignored instead of causing out-of-bounds or stale status-byte reads.

KASAN report as below:

BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()
Read of size 1
Call trace:
  belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)
  __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)
  dummy_timer() (?:?)
  __hrtimer_run_queues() (kernel/time/hrtimer.c:1968)
  hrtimer_run_softirq() (kernel/time/hrtimer.c:2001)
  handle_softirqs() (kernel/softirq.c:579)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
---
v2:
- Drop the transfer_buffer_length check; urb->actual_length is bounded
  by the URB transfer buffer length.
- Add the KASAN validation report.
- Add Assisted-by tag.

 drivers/usb/serial/belkin_sa.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/belkin_sa.c b/drivers/usb/serial/belkin_sa.c
index 38ac910b1082d..1e0d9041969b3 100644
--- a/drivers/usb/serial/belkin_sa.c
+++ b/drivers/usb/serial/belkin_sa.c
@@ -193,6 +193,8 @@ static void belkin_sa_read_int_callback(struct urb *urb)
 	}
 
 	usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data);
+	if (urb->actual_length < BELKIN_SA_MSR_INDEX + 1)
+		goto exit;
 
 	/* Handle known interrupt data */
 	/* ignore data[0] and data[1] */
-- 
2.43.0

Re: [PATCH v2] USB: serial: belkin_sa: validate interrupt status length

[Johan Hovold]

On Tue, May 19, 2026 at 07:11:50PM +0800, Zhang Cen wrote:
> The Belkin interrupt callback treats interrupt data as a four-byte
> status report and reads LSR/MSR fields at offsets 2 and 3. The
> interrupt-in buffer length is derived from endpoint wMaxPacketSize, and
> short interrupt transfers may complete successfully with a smaller
> actual_length.
> 
> Check the completed interrupt packet length before parsing status
> fields so short interrupt endpoints and short successful packets are
> ignored instead of causing out-of-bounds or stale status-byte reads.
> 
> KASAN report as below:
> 
> BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()
> Read of size 1

> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
> ---
> v2:
> - Drop the transfer_buffer_length check; urb->actual_length is bounded
>   by the URB transfer buffer length.
> - Add the KASAN validation report.
> - Add Assisted-by tag.

Applied, thanks.

Johan