linux-kernel - Re: [PATCH] Missing usb_find

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080124172049.GA9665@kroah.com>
Date:	Thu, 24 Jan 2008 09:20:49 -0800
From:	Greg KH <greg@...ah.com>
To:	Pekka Enberg <penberg@...helsinki.fi>
Cc:	Wilco Beekhuizen <wilcobeekhuizen@...il.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Missing usb_find_device symbol from usb.c

On Thu, Jan 24, 2008 at 07:06:39PM +0200, Pekka Enberg wrote:
> Hi Greg,
> 
> On Jan 24, 2008 6:44 PM, Greg KH <greg@...ah.com> wrote:
> > No, that's not the problem.  The code should just be using
> > usb_register_driver() and then doing what it needs to do in the probe()
> > callback, like any other USB driver.
> >
> > By calling usb_find_device() it allows more than one driver to talk to
> > the device at the same time, setting it up for some very bad things to
> > possibly happen to the device.
> >
> > So a simple code change should be all that is needed to properly fix
> > this.
> >
> > If you want, I can make up a patch, just point me at the version you
> > wish me to modify.
> 
> As I already mentioned in private, the code is here:
> 
> http://www.init0.nl/iriverfs-r0.1.0.1-linux-2.6.23.patch.bz2
> 
> It's basically abusing the USB driver stack with a ->probe() function
> that returns -ENODEV and doing device discovery at mount time. That,
> however, is also broken as it assumes there's only one device plugged
> in (we're not passing any device identifier to sys_mount).

By returning -ENODEV, that still allows some other driver or user
through usbfs to come in and start talking to the device, while this
"driver" also touches it.  Not nice.

> So it's not a simple code change at all.

Just create a root directory for every device that is seen in the
probe() function.  That should be pretty simple to do.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/