linux-kernel - [PATCH V3] USB: gadget: epautoconf: fix ep maxpacket check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <1380613976-19959-1-git-send-email-r.baldyga@samsung.com>
Date:	Tue, 01 Oct 2013 09:52:56 +0200
From:	Robert Baldyga <r.baldyga@...sung.com>
To:	balbi@...com
Cc:	gregkh@...uxfoundation.org, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org, b.zolnierkie@...sung.com,
	m.szyprowski@...sung.com, andrzej.p@...sung.com,
	Robert Baldyga <r.baldyga@...sung.com>
Subject: [PATCH V3] USB: gadget: epautoconf: fix ep maxpacket check

This patch fix validation of maxpacket value given in endpoint descriptor.
Add check of maxpacket for bulk endpoints. If maxpacket is not set in
descriptor, it's set to maximum value for given type on endpoint in used
speed.

Correct maxpacket value is:

             FULL-SPEED        HIGH-SPEED   SUPER-SPEED
BULK         8, 16, 32, 64     512          1024
INTERRUPT    1..64             1..1024      1..1024
ISOCHRONOUS  1..1023           1..1024      1..1024

Signed-off-by: Robert Baldyga <r.baldyga@...sung.com>
---

Hello,

This is third version of my patch. Form last version I have fixed maxpacket
check for bulk transfers which has to have fixed size in each speed (except
for full speed devices, which allows to use one of four available values).
Also improved handling of descriptors which has not set wMaxPacketSize value.
In this case wMaxPacketSize field is set to maximum value, according to
endpoint type and device speed.

Best regards
Robert Baldyga
Samsung R&D Institute Poland

Changelog:

v3:
- fixed maxpacket check for bulk endpoints
- improved handling of ep descriptors which has not set wMaxPaketSize value

v2: https://lkml.org/lkml/2013/9/30/79
- arrange code for clearity
- fix support for super speed devices

v1: https://lkml.org/lkml/2013/9/27/127

 drivers/usb/gadget/epautoconf.c |   97 ++++++++++++++++++++++++++++++---------
 1 file changed, 75 insertions(+), 22 deletions(-)

diff --git a/drivers/usb/gadget/epautoconf.c b/drivers/usb/gadget/epautoconf.c
index a777f7b..d62e4e9 100644
--- a/drivers/usb/gadget/epautoconf.c
+++ b/drivers/usb/gadget/epautoconf.c
@@ -124,37 +124,90 @@ ep_matches (
 
 	}
 
+	max = 0x7ff & usb_endpoint_maxp(desc);
+
 	/*
-	 * If the protocol driver hasn't yet decided on wMaxPacketSize
-	 * and wants to know the maximum possible, provide the info.
+	 * Test if maxpacket given in descriptor isn't greater than maximum
+	 * packet size for this endpoint
 	 */
-	if (desc->wMaxPacketSize == 0)
-		desc->wMaxPacketSize = cpu_to_le16(ep->maxpacket);
+	if (ep->maxpacket < max)
+		return 0;
 
-	/* endpoint maxpacket size is an input parameter, except for bulk
-	 * where it's an output parameter representing the full speed limit.
-	 * the usb spec fixes high speed bulk maxpacket at 512 bytes.
+	/*
+	 * Test if ep supports maxpacket size set in descriptor.
+	 * If the protocol driver hasn't yet decided on wMaxPacketSize
+	 * (when wMaxPacketSize == 0) and wants to know the maximum possible,
+	 * provide the info.
 	 */
-	max = 0x7ff & usb_endpoint_maxp(desc);
 	switch (type) {
+	case USB_ENDPOINT_XFER_BULK:
+		/*
+		 * LIMITS:
+		 * full speed:    64 bytes
+		 * high speed:   512 bytes
+		 * super speed: 1024 bytes
+		 */
+		if (max == 0) {
+			if (gadget_is_superspeed(gadget))
+				desc->wMaxPacketSize = cpu_to_le16(1024);
+			else if (gadget_is_dualspeed(gadget))
+				desc->wMaxPacketSize = cpu_to_le16(512);
+			else
+				desc->wMaxPacketSize = cpu_to_le16(64);
+		} else {
+			if (max > 1024)
+				return 0;
+			if (!gadget_is_superspeed(gadget) && max > 512)
+				return 0;
+			if (!gadget_is_dualspeed(gadget) && max > 64)
+				return 0;
+		}
+		break;
+
 	case USB_ENDPOINT_XFER_INT:
-		/* INT:  limit 64 bytes full speed, 1024 high/super speed */
-		if (!gadget_is_dualspeed(gadget) && max > 64)
-			return 0;
-		/* FALLTHROUGH */
+		/*
+		 * LIMITS:
+		 * full speed:		64 bytes
+		 * high/super speed:  1024 bytes
+		 * multiple transactions per microframe only for super speed
+		 */
+		if (max == 0) {
+			if (gadget_is_dualspeed(gadget))
+				desc->wMaxPacketSize = cpu_to_le16(1024);
+			else
+				desc->wMaxPacketSize = cpu_to_le16(64);
+		} else {
+			if (max > 1024)
+				return 0;
+			if (!gadget_is_superspeed(gadget))
+				if ((desc->wMaxPacketSize & cpu_to_le16(3<<11)))
+					return 0;
+			if (!gadget_is_dualspeed(gadget) && max > 64)
+				return 0;
+		}
+		break;
 
 	case USB_ENDPOINT_XFER_ISOC:
-		/* ISO:  limit 1023 bytes full speed, 1024 high/super speed */
-		if (ep->maxpacket < max)
-			return 0;
-		if (!gadget_is_dualspeed(gadget) && max > 1023)
-			return 0;
-
-		/* BOTH:  "high bandwidth" works only at high speed */
-		if ((desc->wMaxPacketSize & cpu_to_le16(3<<11))) {
-			if (!gadget_is_dualspeed(gadget))
+		/*
+		 * LIMITS:
+		 * full speed:	     1023 bytes
+		 * high/super speed: 1024 bytes
+		 * multiple transactions per microframe for high/super speed
+		 */
+		if (max == 0) {
+			if (gadget_is_dualspeed(gadget))
+				desc->wMaxPacketSize = cpu_to_le16(1024);
+			else
+				desc->wMaxPacketSize = cpu_to_le16(1023);
+		} else {
+			if (max > 1024)
 				return 0;
-			/* configure your hardware with enough buffering!! */
+			if (!gadget_is_dualspeed(gadget)) {
+				if (max > 1023)
+					return 0;
+				if ((desc->wMaxPacketSize & cpu_to_le16(3<<11)))
+					return 0;
+			}
 		}
 		break;
 	}
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/