linux-kernel - Re: OOPS after connection Droids MuIn USB display

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 06 May 2011 18:57:59 +0200
From:	Erik Slagter <erik@...gter.name>
To:	Maxin John <maxin.john@...il.com>
CC:	linux-kernel@...r.kernel.org
Subject: Re: OOPS after connection Droids MuIn USB display

Yeah, I've found it!

As I mentioned earlier, the device appears to have a control interface 
and no data interface. The current usb cdc-acm code doesn't account for 
this and so yields a oops because data_interface is null.

I've "fixed" it very dirtily by changing these lines:

if (call_interface_num > 0) {
     dev_dbg(&intf->dev, "No union descriptor, using call management 
descriptor\n");
data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = 
call_interface_num));

into:

if (call_interface_num > 0) {
     dev_dbg(&intf->dev, "No union descriptor, using call management 
descriptor\n");
data_interface = usb_ifnum_to_if(usb_dev, 0);

I can't give an exact patch because the source is full of added debug 
printk's now ;-)

As far as I understand it, this change results in data_interface to be 
set equal to control_interface and later on this gets dealed with properly.

And now it not only no longer oopses, it actually works!

If you're planning to make a quirk of it, the USB ID is 04d8:000b 
"Microchip Technology, Inc. PIC18F2550 (32K Flashable 10 Channel, 10 Bit 
A/D USB Microcontroller"

lsusb says:

Bus 002 Device 018: ID 04d8:000b Microchip Technology, Inc. PIC18F2550 
(32K Flashable 10 Channel, 10 Bit A/D USB Microcontroller)
Device Descriptor:
   bLength                18
   bDescriptorType         1
   bcdUSB               2.00
   bDeviceClass            2 Communications
   bDeviceSubClass         2 Abstract (modem)
   bDeviceProtocol         1 AT-commands (v.25ter)
   bMaxPacketSize0        64
   idVendor           0x04d8 Microchip Technology, Inc.
   idProduct          0x000b PIC18F2550 (32K Flashable 10 Channel, 10 
Bit A/D USB Microcontroller)
   bcdDevice            0.00
   iManufacturer           1 DROIDS
   iProduct                2 VCOM
   iSerial                 0
   bNumConfigurations      1
   Configuration Descriptor:
     bLength                 9
     bDescriptorType         2
     wTotalLength           53
     bNumInterfaces          1
     bConfigurationValue     1
     iConfiguration          0
     bmAttributes         0xa0
       (Bus Powered)
       Remote Wakeup
     MaxPower              500mA
     Interface Descriptor:
       bLength                 9
       bDescriptorType         4
       bInterfaceNumber        0
       bAlternateSetting       0
       bNumEndpoints           3
       bInterfaceClass         2 Communications
       bInterfaceSubClass      2 Abstract (modem)
       bInterfaceProtocol      1 AT-commands (v.25ter)
       iInterface              0
       CDC Header:
         bcdCDC               1.10
       CDC Call Management:
         bmCapabilities       0x01
           call management
         bDataInterface          1
       CDC ACM:
         bmCapabilities       0x06
           sends break
           line coding and serial state
       Endpoint Descriptor:
         bLength                 7
         bDescriptorType         5
         bEndpointAddress     0x83  EP 3 IN
         bmAttributes            3
           Transfer Type            Interrupt
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0008  1x 8 bytes
         bInterval              10
       Endpoint Descriptor:
         bLength                 7
         bDescriptorType         5
         bEndpointAddress     0x84  EP 4 IN
         bmAttributes            2
           Transfer Type            Bulk
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0040  1x 64 bytes        bInterval 
       10
       Endpoint Descriptor:
         bLength                 7
         bDescriptorType         5
         bEndpointAddress     0x04  EP 4 OUT
         bmAttributes            2
           Transfer Type            Bulk
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0040  1x 64 bytes
         bInterval              10
Device Status:     0x0001
   Self Powered

Thanks.


Download attachment "smime.p7s" of type "application/pkcs7-signature" (5110 bytes)