linux-kernel - Re: [PATCH] usb: chipidea: debug: check before accessing ci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 19 May 2017 10:14:17 +0200
From:   Michael Thalmeier <michael.thalmeier@...e.at>
To:     Peter Chen <hzpeterchen@...il.com>
Cc:     Peter Chen <Peter.Chen@....com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: chipidea: debug: check before accessing ci_role

On Fri, May 19, 2017 at 09:15:40AM +0800, Peter Chen wrote:
> On Thu, May 18, 2017 at 04:14:14PM +0200, Michael Thalmeier wrote:
> > ci_role BUGs when the role is >= CI_ROLE_END.
> > 
> > Signed-off-by: Michael Thalmeier <michael.thalmeier@...e.at>
> > ---
> >  drivers/usb/chipidea/debug.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c
> > index 6d23eed..1c31e8a 100644
> > --- a/drivers/usb/chipidea/debug.c
> > +++ b/drivers/usb/chipidea/debug.c
> > @@ -294,7 +294,8 @@ static int ci_role_show(struct seq_file *s, void *data)
> >  {
> >  	struct ci_hdrc *ci = s->private;
> >  
> > -	seq_printf(s, "%s\n", ci_role(ci)->name);
> > +	if (ci->role != CI_ROLE_END)
> > +		seq_printf(s, "%s\n", ci_role(ci)->name);
> >  
> >  	return 0;
> >  }
> 
> By the way, how can you trigger this issue?

It is quite easy to trigger.
I have an USB OTG adapter cable connected to the micro-USB port of my device.
When the cable is connected, the port has the "host" role. When
disconnected, the role changes to "gadget".

When polling (1 second interval) the role file while
connecting/disconnecting the USB OTG cable, the error occurs within
the first few tries.

> Do you mind sending another patch to fix the same issue for ci_role_show
> at core.c?

I did not see, that there is now another place this is used. Will send
a patch later.

> 
> -- 
> 
> Best Regards,
> Peter Chen

Regards,
Michael