CVE-2026-98771: usb: storage: sierra_ms: reject short SWoC info transfers

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: sierrams: reject short SWoC info transfers

sierragetswocinfo() requests sizeof(struct swocinfo) (60) bytes from the device via usbcontrolmsg(), but its callers only treat a negative return value as failure. A device that answers the vendor-specific GetSwocInfo request with a short IN transfer is therefore accepted, leaving the tail of the freshly allocated (kmalloc(), non-zeroing) swocinfo buffer uninitialized.

truinstshow() subsequently prints swocInfo->rev, swocInfo->LinuxSKU and swocInfo->LinuxVer from that buffer into the world-readable (0444) "truinst" sysfs attribute. An emulated/malicious USB device (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes of stale kernel heap memory (kmalloc-64) to unprivileged userspace, once per sysfs read, indefinitely. On kernels built without initonalloc this leaks recently freed heap contents.

Only accept the transfer when the full structure was received. sierramsinit() already retries failed queries, so well-behaved devices are unaffected.