linux-kernel - broken modules.alias entries for some USB devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 21 Sep 2006 22:30:35 +0400
From:	Sergey Vlasov <vsu@...linux.ru>
To:	iSteve <isteve@...ez.cz>
Cc:	"Randy.Dunlap" <rdunlap@...otime.net>,
	linux-kernel@...r.kernel.org, linux-usb-devel@...ts.sourceforge.net
Subject: broken modules.alias entries for some USB devices

On Thu, 21 Sep 2006 16:54:24 +0200 iSteve wrote:

> I've got one more question, this time regarding modules.usbmap.
> 
> -modules.usbmap:
> ibmcam 0x000f 0x0545 0x8080 0x0002 0x0002 0x00 0x00 0x00 0x00 0x00 0x00 0x0
> ibmcam 0x000f 0x0545 0x8080 0x030a 0x030a 0x00 0x00 0x00 0x00 0x00 0x00 0x0
> ibmcam 0x000f 0x0545 0x8080 0x0301 0x0301 0x00 0x00 0x00 0x00 0x00 0x00 0x0
> ibmcam 0x000f 0x0545 0x8002 0x030a 0x030a 0x00 0x00 0x00 0x00 0x00 0x00 0x0
> ibmcam 0x000f 0x0545 0x800c 0x030a 0x030a 0x00 0x00 0x00 0x00 0x00 0x00 0x0
> ibmcam 0x000f 0x0545 0x800d 0x030a 0x030a 0x00 0x00 0x00 0x00 0x00 0x00 0x0
> -EOF
> 
> -With corresponding aliases:
> alias usb:v0545p8080d0002dc*dsc*dp*ic*isc*ip* ibmcam
> alias usb:v0545p8080d030[10-9]dc*dsc*dp*ic*isc*ip* ibmcam
> alias usb:v0545p8080d0301dc*dsc*dp*ic*isc*ip* ibmcam
> alias usb:v0545p8002d030[10-9]dc*dsc*dp*ic*isc*ip* ibmcam
> alias usb:v0545p800Cd030[10-9]dc*dsc*dp*ic*isc*ip* ibmcam
> alias usb:v0545p800Dd030[10-9]dc*dsc*dp*ic*isc*ip* ibmcam
> -EOF
> 
> I absolutely do not understand the d030[10-9], where fields bcdDevice_lo and
> bcdDevice_hi are 0x030a...

This surely looks like a bug.

> Looking at drivers/usb/core/usb.c, it'd seem that the MODALIAS sent upon device
> event doesn't have anything like this -- it would have "[...]d030A[...]". So I
> wonder, how it got generated?

scripts/mod/file2alias.c generates these lines from the ID tables.

> -The relevant items in ibmcam.c:
> static struct usb_device_id id_table[] = {
>         { USB_DEVICE_VER(IBMCAM_VENDOR_ID, IBMCAM_PRODUCT_ID, 0x0002, 0x0002) },
>         { USB_DEVICE_VER(IBMCAM_VENDOR_ID, IBMCAM_PRODUCT_ID, 0x030a, 0x030a) },
>         { USB_DEVICE_VER(IBMCAM_VENDOR_ID, IBMCAM_PRODUCT_ID, 0x0301, 0x0301) },
>         { USB_DEVICE_VER(IBMCAM_VENDOR_ID, NETCAM_PRODUCT_ID, 0x030a, 0x030a) },
>         { USB_DEVICE_VER(IBMCAM_VENDOR_ID, VEO_800C_PRODUCT_ID, 0x030a, 0x030a) },
>         { USB_DEVICE_VER(IBMCAM_VENDOR_ID, VEO_800D_PRODUCT_ID, 0x030a, 0x030a) },

The problem is that the bcdDevice field is supposed to be BCD - i.e.,
its hex representation should contain only decimal digits 0..9.
Therefore a proper USB device cannot have bcdDevice == 0x030a.
Apparently some ibmcam devices violate this and use the bcdDevice field
as if it was binary.

>         { }
> };
> -EOF
> 
> -And the resulting alias part of modinfo:
> alias: usb:v0545p8080d0002dc*dsc*dp*ic*isc*ip*
> alias: usb:v0545p8080d030[10-9]dc*dsc*dp*ic*isc*ip*
> alias: usb:v0545p8080d0301dc*dsc*dp*ic*isc*ip*
> alias: usb:v0545p8002d030[10-9]dc*dsc*dp*ic*isc*ip*
> alias: usb:v0545p800Cd030[10-9]dc*dsc*dp*ic*isc*ip*
> alias: usb:v0545p800Dd030[10-9]dc*dsc*dp*ic*isc*ip*

The code in scripts/mod/file2alias.c assumes that the bcdDevice_lo and
bcdDevice_hi field contain proper BCD data.  Seems that, thanks to buggy
hardware, this assumption is incorrect, and the code needs to support
any hex numbers there.

Content of type "application/pgp-signature" skipped