From ae0c7c6b53ea7a5a111645e4e8e0550c75ca7857 Mon Sep 17 00:00:00 2001 From: zjzhao-eda Date: Mon, 24 Aug 2026 14:56:25 +0800 Subject: [PATCH] usbip: host: ignore number_of_packets for non-isoc URBs number_of_packets is only meaningful for isochronous URBs. The USB/IP stub currently copies the value from the CMD_SUBMIT PDU into the local URB verbatim for all endpoint types. Some clients (e.g. usbip-win) leave number_of_packets uninitialized for non-isoc URBs, so a garbage/huge value reaches usb_submit_urb(). Host controllers that size per-URB allocations by this field (e.g. dwc2's dwc2_hcd_urb_alloc(), which always sizes the iso descriptor array by urb->number_of_packets) then attempt a multi-gigabyte allocation that fails with -ENOMEM, making usbip-host reset the device in an endless loop (older dwc_otg crashes outright instead). Sanitize number_of_packets to 0 for non-isochronous endpoints in the stub. This is a strict no-op for well-behaved clients (Linux vhci already sends 0 for non-isoc URBs) and fixes the dwc2/dwc_otg failures. Signed-off-by: zjzhao-eda --- drivers/usb/usbip/stub_rx.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c index 9aa30ef76f3bc4..05cce81b71d726 100644 --- a/drivers/usb/usbip/stub_rx.c +++ b/drivers/usb/usbip/stub_rx.c @@ -481,6 +481,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev, if (pipe == -1) return; + if (!usb_pipeisoc(pipe)) + pdu->u.cmd_submit.number_of_packets = 0; /* * Smatch reported the error case where use_sg is true and buf_len is 0.