USB: serial: belkin_sa: validate interrupt status length

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: belkin_sa: validate interrupt status length

The Belkin interrupt callback treats interrupt data as a four-byte

status report and reads LSR/MSR fields at offsets 2 and 3. The

interrupt-in buffer length is derived from endpoint wMaxPacketSize, and

short interrupt transfers may complete successfully with a smaller

actual_length.

Check the completed interrupt packet length before parsing status

fields so short interrupt endpoints and short successful packets are

ignored instead of causing out-of-bounds or stale status-byte reads.

KASAN report as below:

BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()

Read of size 1

Call trace:

belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)

__usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)

dummy_timer() (?:?)