linux-kernel - Re: [REGRESSION][BISECTED] flood of "hid-generic ... control queue full" since v5.14-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YRpnfJ719DwPu2B0@kroah.com>
Date:   Mon, 16 Aug 2021 15:26:20 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Michal Kubecek <mkubecek@...e.cz>
Cc:     linux-usb@...r.kernel.org, Alan Stern <stern@...land.harvard.edu>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
        Jiri Kosina <jikos@...nel.org>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>
Subject: Re: [REGRESSION][BISECTED] flood of "hid-generic ... control queue
 full" since v5.14-rc1

On Mon, Aug 16, 2021 at 03:00:59PM +0200, Michal Kubecek wrote:
> Hello,
> 
> starting with v5.14-rc1, my kernel log gets flooded with messages
> 
>   hid-generic 0003:051D:0002.0002: control queue full
> 
> at rate of ~33 per second. Device 051d:0002 is an APC UPS (BR-650 VA).
> I bisected the issue to commit
> 
>   7652dd2c5cb7 ("USB: core: Check buffer length matches wLength for control transfers")
> 
> Reverting this commit on top of v5.14-rc6 resolves the issue. I suspect
> the problem is some missing cleanup when usb_submit_urb() bails out on
> the newly added check but I'm not familiar enough with the code to see
> what is missing or if the problem is on USB or HID side.

But the message in the above commit does not match the message you are
seeing in your log.

Your message is coming from the hid-core.c file, where it checks to
verify if you have enough room in the buffer.  Ah, is the buffer filling
up because a driver is trying to send the wrong amount of data?

thanks,

greg k-h