linux-kernel - Re: [PATCH] usb: gadget/composite : Avoid crash with bad gadget drivers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130812180804.GE27954@radagast>
Date:	Mon, 12 Aug 2013 13:08:04 -0500
From:	Felipe Balbi <balbi@...com>
To:	Philippe De Swert <philippe.deswert@...lamobile.com>
CC:	<linux-usb@...r.kernel.org>, <gregkh@...uxfoundation.org>,
	<balbi@...com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] usb: gadget/composite : Avoid crash with bad gadget
 drivers

On Fri, Aug 09, 2013 at 09:23:08PM +0300, Philippe De Swert wrote:
> Some bad gadget drivers do not check the return status of usb_add_config.

fix the gadget driver

> Thus they get a not correctly initialized config and when this gadget gets
> deactivated the whole kernel crashes. Since on initialization failure cdev
> is set to NULL it can be used to detect this problem situation. It can be
> argued that the faulty gadget driver should be fixed, but imho it is better
> to avoid crashing the kernel and letting the gadget developer know he/she
> is making a mistake. And have the developer of said gadget driver then fix
> the problem of course.
> 
> Signed-off-by: Philippe De Swert <philippe.deswert@...lamobile.com>
> ---
>  drivers/usb/gadget/composite.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
> index 55f4df6..e019bb5 100644
> --- a/drivers/usb/gadget/composite.c
> +++ b/drivers/usb/gadget/composite.c
> @@ -848,12 +848,18 @@ void usb_remove_config(struct usb_composite_dev *cdev,
>  {
>  	unsigned long flags;
>  
> +	if (config->cdev == NULL) {
> +		pr_warn("Calling usb_remove_config without a matching usb_add_config!\n");
> +		goto end;
> +	}

I would take a WARN() only, but let the crash happen and fix the gadget
driver.

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)