[greybus-dev] Re: [syzbot] [greybus?] [usb?] KASAN: slab-out-of-bounds Read in gb_svc_request_handler

On Thu, Nov 05, 2026 at 08:08:01AM -0600, Alex Elder wrote:

Here is what I see happening at the beginning of gb_connection_recv():

• If the connection is disabled or offloaded, return immediately
• If the size of the buffer (passed in as the "size" argument) is less than the size of an operation message header, return
• If the 16-bit size embedded in the message header is less than the size of the buffer, return

In other words, after these checks, we know:

sizeof(header) <= buffer size (size) AND buffer size (size) <= size encoded in the header (msg_size)

No, it does not verify this, it verify: size encoded in the header <= size (buffer size)

Therefore (transitive property), this is true:

sizeof(header) <= size encoded in the header (msg_size)

So, the transitive property is not true.

I have sent a patch for this bug which verify the msg_size and header separately, which fixes the out of bounds read. patch link: https://lore.kernel.org/all/20261106094303.55158-1-chandradhar.2003@gmail.co...

Hey please review the patch if there is something wrong or there are any other way to fix the bug.

Thanks.

And it's not possible after these checks for this to be true:

header.size < sizeof(struct gb_operation_msg_hdr)

or put another way:

msg_size < sizeof(header)        cannot hold

It surprises me this would be missed in the AI summary--and I fear I'm mistaken. If I'm missing something or wrong about this, please feel free to say so.

			-Alex