Re: [PATCH 2/3] usb: core: strengthen size check in usb_parse_interface()

[Alan Stern <stern@rowland.harvard.edu>]

On Mon, Jul 13, 2026 at 05:43:52PM +0200, Griffin Kroah-Hartman wrote:
> Change the size check from size > 0 to size >= sizeof(struct
> usb_descriptor_header) in usb_parse_interface().  This prevents a
> malicious device from utilizing trailing bytes to incur an OOB read.

No, because usb_parse_configuration() has already performed this check.  
A malicious device can't avoid that earlier check, and so we don't need 
to do it again.

> This matches the size check in usb_parse_configuration() as well.

Right.  There's no point in doing the same size check twice.

Alan Stern

> 
> Assisted-by: gkh_clanker_t1000
> Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
> ---
>  drivers/usb/core/config.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
> index 17c93e95945f..91a51cedc1b8 100644
> --- a/drivers/usb/core/config.c
> +++ b/drivers/usb/core/config.c
> @@ -623,7 +623,7 @@ static int usb_parse_interface(struct device *ddev, int cfgno,
>  
>  	/* Parse all the endpoint descriptors */
>  	n = 0;
> -	while (size > 0) {
> +	while (size >= sizeof(struct usb_descriptor_header)) {
>  		if (((struct usb_descriptor_header *) buffer)->bDescriptorType
>  		     == USB_DT_INTERFACE)
>  			break;
> 
> -- 
> 2.55.0
> 
>