| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sun, 25 Sep 2011 14:46:51 +0200
From: Matthias Dellweg <2500@....de>
To: Greg Kroah-Hartman <gregkh@...e.de>
Cc: Alan Stern <stern@...land.harvard.edu>,
<linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] enable usb control message with class specific request
Am Fri, 23 Sep 2011 14:31:40 -0400 (EDT)
schrieb Alan Stern <stern@...land.harvard.edu>:
> On Fri, 23 Sep 2011, Matthias Dellweg wrote:
>
> > Am Fri, 23 Sep 2011 12:16:40 -0400 (EDT)
> > schrieb Alan Stern <stern@...land.harvard.edu>:
> > > This is basically okay. But your mailer has mangled the
> > > whitespace. [...]
> > > Alan Stern
> >
> > OK, hoping that my mailer doesn't get wild again, this is the
> > polished version following your suggestions.
> > Thanks for your help!
> > Matthias Dellweg
> >
> > From b7c4b6f5780296fd0d53d66e08d5bce0dc450b7f Mon Sep 17 00:00:00
> > 2001 From: Matthias Dellweg <2500@....de>
> > Date: Fri, 23 Sep 2011 19:32:39 +0200
> > Subject: [PATCH] drivers/usb/core/devio.c: Check for printer class
> > specific request
> >
> > Signed-off-by: Matthias Dellweg <2500@....de>
> > ---
> > drivers/usb/core/devio.c | 20 +++++++++++++++++---
> > 1 files changed, 17 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
> > index 37518df..e4175cc 100644
> > --- a/drivers/usb/core/devio.c
> > +++ b/drivers/usb/core/devio.c
> > @@ -607,9 +607,10 @@ static int findintfep(struct usb_device *dev,
> > unsigned int ep) }
> >
> > static int check_ctrlrecip(struct dev_state *ps, unsigned int
> > requesttype,
> > - unsigned int index)
> > + unsigned int request, unsigned int
> > index) {
> > int ret = 0;
> > + struct usb_host_interface *alt_setting;
> >
> > if (ps->dev->state != USB_STATE_UNAUTHENTICATED
> > && ps->dev->state != USB_STATE_ADDRESS
> > @@ -618,6 +619,18 @@ static int check_ctrlrecip(struct dev_state
> > *ps, unsigned int requesttype, if (USB_TYPE_VENDOR ==
> > (USB_TYPE_MASK & requesttype)) return 0;
> >
> > + /*
> > + * check for the special corner case 'get_device_id' in
> > the printer
> > + * class specification, where wIndex is (interface << 8 |
> > altsetting)
> > + */
> > + if (requesttype == 0xa1 && request == 0) {
> > + alt_setting =
> > usb_find_alt_setting(ps->dev->actconfig,
> > + index >> 8,
> > index & 0xff);
> > + if (alt_setting
> > + && alt_setting->desc.bInterfaceClass ==
> > USB_CLASS_PRINTER)
> > + index >>= 8;
> > + }
> > +
> > index &= 0xff;
> > switch (requesttype & USB_RECIP_MASK) {
> > case USB_RECIP_ENDPOINT:
> > @@ -770,7 +783,8 @@ static int proc_control(struct dev_state *ps,
> > void __user *arg)
> > if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
> > return -EFAULT;
> > - ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.wIndex);
> > + ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.bRequest,
> > + ctrl.wIndex);
> > if (ret)
> > return ret;
> > wLength = ctrl.wLength; /* To suppress 64k
> > PAGE_SIZE warning */ @@ -1100,7 +1114,7 @@ static int
> > proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
> > kfree(dr); return -EINVAL;
> > }
> > - ret = check_ctrlrecip(ps, dr->bRequestType,
> > + ret = check_ctrlrecip(ps, dr->bRequestType,
> > dr->bRequest, le16_to_cpup(&dr->wIndex));
> > if (ret) {
> > kfree(dr);
> >
>
> This looks fine to me. Greg may ask you for a non-empty patch
> description when you submit it to him.
>
> Acked-by: Alan Stern <stern@...land.harvard.edu>
>
> Alan Stern
Hi Greg,
I hear you are the right person to ask for including this patch.
The relevant section in the printer class spec is 4.2.1. I believe this
is a really special corner case, because I did not find another such
'violation' of the common usb spec on a quick search.
The hardware I tested this patch with is a Prolific
USB->Centronics cable (067b:2305).
Matthias Dellweg
>From 5bdb64cbee0b2f353d3bc444c147ba78f34a1f69 Mon Sep 17 00:00:00 2001
From: Matthias Dellweg <2500@....de>
Date: Sun, 25 Sep 2011 14:26:25 +0200
Subject: [PATCH] usb/core/devio.c: Check for printer class specific request
In the usb printer class specific request get_device_id the value of
wIndex is (interface << 8 | altsetting) instead of just interface.
This enables the detection of some printers with libusb.
Acked-by: Alan Stern <stern@...land.harvard.edu>
Signed-off-by: Matthias Dellweg <2500@....de>
---
drivers/usb/core/devio.c | 21 ++++++++++++++++++---
1 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 37518df..1d73709 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -607,9 +607,10 @@ static int findintfep(struct usb_device *dev, unsigned int ep)
}
static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
- unsigned int index)
+ unsigned int request, unsigned int index)
{
int ret = 0;
+ struct usb_host_interface *alt_setting;
if (ps->dev->state != USB_STATE_UNAUTHENTICATED
&& ps->dev->state != USB_STATE_ADDRESS
@@ -618,6 +619,19 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
return 0;
+ /*
+ * check for the special corner case 'get_device_id' in the printer
+ * class specification, where wIndex is (interface << 8 | altsetting)
+ * instead of just interface
+ */
+ if (requesttype == 0xa1 && request == 0) {
+ alt_setting = usb_find_alt_setting(ps->dev->actconfig,
+ index >> 8, index & 0xff);
+ if (alt_setting
+ && alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
+ index >>= 8;
+ }
+
index &= 0xff;
switch (requesttype & USB_RECIP_MASK) {
case USB_RECIP_ENDPOINT:
@@ -770,7 +784,8 @@ static int proc_control(struct dev_state *ps, void __user *arg)
if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
return -EFAULT;
- ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.wIndex);
+ ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.bRequest,
+ ctrl.wIndex);
if (ret)
return ret;
wLength = ctrl.wLength; /* To suppress 64k PAGE_SIZE warning */
@@ -1100,7 +1115,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
kfree(dr);
return -EINVAL;
}
- ret = check_ctrlrecip(ps, dr->bRequestType,
+ ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
le16_to_cpup(&dr->wIndex));
if (ret) {
kfree(dr);
--
1.7.6.3
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists