linux-kernel - Re: Protecting uvcvideo againt USB device disconnect [Was: Re: Protecting usb_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 19 Aug 2020 21:31:22 -0400
From:   Alan Stern <stern@...land.harvard.edu>
To:     Guenter Roeck <linux@...ck-us.net>
Cc:     Laurent Pinchart <laurent.pinchart@...asonboard.com>,
        Hans Verkuil <hverkuil-cisco@...all.nl>,
        linux-usb <linux-usb@...r.kernel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        linux-media@...r.kernel.org, linux-uvc-devel@...ts.sourceforge.net,
        Sakari Ailus <sakari.ailus@....fi>
Subject: Re: Protecting uvcvideo againt USB device disconnect [Was: Re:
 Protecting usb_set_interface() against device removal]

On Wed, Aug 19, 2020 at 04:08:51PM -0700, Guenter Roeck wrote:

> usb_set_interface() should not be called anymore after uvc_disconnect(),
> or at east I think so (is that documented anywhere ?).

It may be documented somewhere, but basically it goes without saying.  

A main feature of the device model design is that drivers get bound to 
devices by having their probe routine called, and they get unbound by 
having their disconnect routine called.  It should go without saying 
that once a driver is unbound from a device, it must not communicate 
with that device any more.

It might be nice if this requirement could be enforced (say in the USB 
core), but doing so is impractical.  It would require every I/O request 
to include some sort of cookie proving that the caller is authorized to 
make the request.  That's not how the kernel works; it trusts drivers 
to generally do the right thing without constant checking.

Alan Stern