linux-kernel - Re: [PATCH net v2] r8152: check the informaton of the device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YKtZXsmkNaMJgNYe@hovoldconsulting.com>
Date:   Mon, 24 May 2021 09:44:30 +0200
From:   Johan Hovold <johan@...nel.org>
To:     Hayes Wang <hayeswang@...ltek.com>
Cc:     Greg KH <gregkh@...uxfoundation.org>,
        "kuba@...nel.org" <kuba@...nel.org>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        nic_swsd <nic_swsd@...ltek.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "syzbot+95afd23673f5dd295c57@...kaller.appspotmail.com" 
        <syzbot+95afd23673f5dd295c57@...kaller.appspotmail.com>
Subject: Re: [PATCH net v2] r8152: check the informaton of the device

On Mon, May 24, 2021 at 01:49:33AM +0000, Hayes Wang wrote:
> Johan Hovold <johan@...nel.org>
> > Sent: Saturday, May 22, 2021 4:07 PM
> [...]
> > > > +	if (usb_endpoint_num(in) != 1) {
> > > > +		dev_err(&intf->dev, "Invalid Rx Endpoint\n");
> > >
> > > "Invalid number of Rx endpoints"
> > 
> > Here it is the endpoint number (address) that is being checked so
> > "number of" would be wrong.
> > 
> > That said, perhaps none of these checks are even needed a bit depending
> > on how the driver is implemented. That is, if it hardcodes the endpoint
> > addresses or uses the result from usb_find_common_endpoints() above
> > (which I realise now that it does not so these checks are probably still
> > needed).
> 
> The purpose of the checks is to find out the fake devices. That is, even
> the device supports in, out, and interrupt endpoints, it is treated as
> fake or malicious device, if the addresses of these endpoints are wrong.
> Therefore, I would keep the checks.

Strictly, you need to check for bad input which could cause your driver
to crash or malfunction. Generally you don't need to verify endpoint
addresses unless the driver is hardcoding those. But since that is
precisely what this particular driver is doing, these checks indeed need
to stay.

Johan