linux-kernel - Re: gadgetfs: how to wait for USB device initialization?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.1706131032270.2265-100000@iolanthe.rowland.org>
Date:   Tue, 13 Jun 2017 10:39:49 -0400 (EDT)
From:   Alan Stern <stern@...land.harvard.edu>
To:     Andrey Konovalov <andreyknvl@...gle.com>
cc:     Felipe Balbi <balbi@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Kees Cook <keescook@...omium.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Elena Reshetova <elena.reshetova@...el.com>,
        USB list <linux-usb@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>
Subject: Re: gadgetfs: how to wait for USB device initialization?

On Tue, 13 Jun 2017, Andrey Konovalov wrote:

> Hi!
> 
> I'm trying to use gadgetfs to fuzz USB device drivers by simply
> connecting random devices for now.
> 
> What I want to achieve right now is the following:
> 
> 1. mount gadgetfs
> 2. emulate connection of a new USB device
> 3. wait for the device to finish initializing
> 4. unmount gadgetfs
> 5. goto 1
> 
> The question is how do I wait for the device to finish initializing
> (the corresponding USB driver to finish probing?) before unmounting
> gadgetfs? As I understand, when I write device description to
> "/dev/gadget/dummy_udc" the initialization happens asynchronously
> after writing is done.

The most generic approach is to monitor the system log and wait for the 
appropriate messages to show up.  If you know a little more about the 
device (such as which driver it will bind to), you might be able to use 
a udev library to do the monitoring.

Or since the gadget driver in this case is part of your program, you 
could wait until your program sees all the USB requests that get sent 
during the initialization and probing procedures.

For a really simple approach, just wait a fixed amount of time, like 10 
seconds.  Unless the system is highly loaded or probing takes a lot 
longer than usual, that should be enough.

Alan Stern

> To mount and unmount gadgetfs right now I do:
> mount("none", "/dev/gadget", "gadgetfs", 0, NULL)
> umount2("/dev/gadget", MNT_FORCE | MNT_DETACH)
> 
> Thanks!