Re: [PATCH] usb: mon: Fix slab-out-of-bounds in mon_bin_event due to unsafe URB transfer_buffer access

From: Alan Stern
Date: Mon Jul 21 2025 - 09:52:10 EST


On Mon, Jul 21, 2025 at 09:22:40AM +0100, Lecomte, Arnaud wrote:
> Hi Alan, thanks for your reply.
>
> Your point raises an important question for me: Is there a specific reason
> why we don’t have
>  a synchronization mechanism in place to protect the URB's transfer buffer ?

Protect it from what? Access by some driver at an inappropriate time?
Drivers are supposed to know (and this is alluded to in the kerneldoc
for usb_submit_urb()) that they aren't allowed to touch the transfer
buffer while an URB is queued.

Alan Stern