Re: [PATCH] USB: serial: sierra: fix slab out-of-bounds read in sierra_instat_callback

[Johan Hovold <johan@kernel.org>]

On Tue, Jul 14, 2026 at 11:11:42AM -0700, Jay Vadayath wrote:
> The interrupt-in URB buffer is allocated based on the endpoint's
> wMaxPacketSize. A device declaring wMaxPacketSize == 8 gets an 8-byte
> buffer from kmalloc-8. When such a device delivers a short packet,
> sierra_instat_callback() still dereferences transfer_buffer as struct
> usb_ctrlrequest and reads a further byte at data[sizeof(*req_pkt)], one
> byte past the end of the allocation.
> 
> Reject the URB when fewer than sizeof(struct usb_ctrlrequest) + 1 bytes
> were received.
> 

Fixes tag missing.

> Cc: stable@vger.kernel.org
> Reported-by: Jay Vadayath <jkrshnmenon@gmail.com>

You shouldn't add a Reported-by for your own patches.

> Reported-by: Lukas Dresel <lukas@artiphishell.com>

Where was this reported?

> Signed-off-by: Jay Vadayath <jkrshnmenon@gmail.com>

You also need to mention that you used an LLM to find, write the commit
message, test and/or fix this issue as documented here:

	Documentation/process/generated-content.rst
	Documentation/process/coding-assistants.rst

> ---
> Apologies for the wall of text in the original mail. I wanted to include
> the artifacts inline so the bug could be independently verified. Just the
> patch this time.
> 
> Same shape of fix as Jiale Yao's option.c patch:
> https://lore.kernel.org/all/20260712170012.3503601-1-yaojiale02@163.com/

And as I and Oliver pointed out in that thread, that fix is not correct.

Johan