linux-kernel - Re: [PATCH] usb: interface: allow drivers declare number of endpoints they need

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 30 Nov 2015 14:56:09 -0800
From:	Dmitry Torokhov <dmitry.torokhov@...il.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	Alan Stern <stern@...land.harvard.edu>,
	Felipe Balbi <balbi@...com>,
	Vladis Dronov <vdronov@...hat.com>,
	USB list <linux-usb@...r.kernel.org>,
	lkml <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] usb: interface: allow drivers declare number of endpoints
 they need

On Mon, Nov 30, 2015 at 2:18 PM, Greg Kroah-Hartman
<gregkh@...uxfoundation.org> wrote:
> On Mon, Nov 30, 2015 at 01:11:50PM -0800, Dmitry Torokhov wrote:
>> USB interface drivers need to check number of endpoints before trying to
>> access/use them. Quite a few drivers only use the default setting
>> (altsetting 0), so let's allow them to declare number of endpoints in
>> altsetting 0 they require to operate and have USB core check it for us
>> instead of having every driver implement check manually.
>>
>> For compatibility, if driver does not specify number of endpoints (i.e.
>> number of endpoints is left at 0) we bypass the check in USB core and
>> expect the driver perform necessary checks on its own.
>>
>> Acked-by: Alan Stern <stern@...land.harvard.edu>
>> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@...il.com>
>> ---
>>
>> Greg, if the patch is reasonable I wonder if I can take it through my
>> tree, as I have a few drivers that do not check number of endpoints
>> properly and will crash the kernel when specially crafted device is
>> plugged in, as reported by Vladis Dronov.
>>
>>  drivers/usb/core/driver.c | 9 +++++++++
>>  include/linux/usb.h       | 7 +++++++
>>  2 files changed, 16 insertions(+)
>>
>> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
>> index 6b5063e..d9f680d 100644
>> --- a/drivers/usb/core/driver.c
>> +++ b/drivers/usb/core/driver.c
>> @@ -306,6 +306,15 @@ static int usb_probe_interface(struct device *dev)
>>
>>       dev_dbg(dev, "%s - got id\n", __func__);
>>
>> +     if (driver->num_endpoints &&
>> +         intf->altsetting[0].desc.bNumEndpoints < driver->num_endpoints) {
>> +
>
> Empty line :(
>
>> +             dev_err(dev, "Not enough endpoints %d (want %d)\n",
>> +                     intf->altsetting[0].desc.bNumEndpoints,
>> +                     driver->num_endpoints);
>
> What can a user do with this?

Report on the lists or throw such device into a bin.

>
>> +             return -EINVAL;
>> +     }
>> +
>>       error = usb_autoresume_device(udev);
>>       if (error)
>>               return error;
>> diff --git a/include/linux/usb.h b/include/linux/usb.h
>> index 447fe29..93f8dfc 100644
>> --- a/include/linux/usb.h
>> +++ b/include/linux/usb.h
>> @@ -1051,6 +1051,11 @@ struct usbdrv_wrap {
>>   * @id_table: USB drivers use ID table to support hotplugging.
>>   *   Export this with MODULE_DEVICE_TABLE(usb,...).  This must be set
>>   *   or your driver's probe function will never get called.
>> + * @num_endpoints: Number of endpoints that should be present in default
>> + *   setting (altsetting 0) the driver needs to operate properly.
>> + *   The probe will be aborted if actual number of endpoints is less
>> + *   than what the driver specified here. 0 means no check should be
>> + *   performed.
>
> I don't understand, a driver can do whatever it wants with the endpoints
> of the interface, why do we need to check/know this ahead of time?  What
> is crashing without this?

The kernel because some drivers do not verify that
intf->altsetting[0].desc.bNumEndpoints >= 1 before referencing
intf->altsetting[0].endpoints[0].

>
> It's up to the driver to check this, if it cares about it.

Instead of duplicating the check in almost every driver is it more
efficient to allow USB core check it for them (if driver requests it
to do so).

>  How many
> drivers do you have that is going to care?

I saw at least 3 that did not check, that's from cursory glance. Plus
we have many that do check explicitly.

>  Why is this suddenly a new
> thing that we haven't run into in the past 15+ years?

We are less trusting now. Before we/some of the drivers believed that
if device has VID/PID that they recognize the rest of descriptors will
have the data we expect, but we can't rely on this anymore.

Thanks.

-- 
Dmitry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/