linux-kernel - Re: [PATCH] usb-storage: Add Brain USB3-FW to IGNORE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 4 Mar 2024 09:29:36 +0700
From: Lars Melin <larsm17@...il.com>
To: Greg KH <gregkh@...uxfoundation.org>
Cc: Alan Stern <stern@...land.harvard.edu>, Tom Hu <huxiaoying@...inos.cn>,
 linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
 usb-storage@...ts.one-eyed-alien.net
Subject: Re: [PATCH] usb-storage: Add Brain USB3-FW to IGNORE_UAS

On 2024-03-03 02:19, Greg KH wrote:
> On Sat, Mar 02, 2024 at 07:06:20PM +0700, Lars Melin wrote:
>> On 2024-03-01 23:53, Alan Stern wrote:
>>>>    drivers/usb/storage/unusual_uas.h | 7 +++++++
>>>>    1 file changed, 7 insertions(+)
>>>>
>>>> diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
>>>> index 1f8c9b16a0fb..98b7ff2c76ba 100644
>>>> --- a/drivers/usb/storage/unusual_uas.h
>>>> +++ b/drivers/usb/storage/unusual_uas.h
>>>> @@ -83,6 +83,13 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
>>>>    		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
>>>>    		US_FL_NO_REPORT_LUNS),
>>>> +/* Reported-by: Tom Hu <huxiaoying@...inos.cn> */
>>>> +UNUSUAL_DEV(0x1234, 0x1234, 0x0000, 0x9999,
>>>
>>> The vendor and product ID values have a suspicious look, but they appear
>>> to be genuine.
>>
>> Hi Alan,
>> it is of course a bogus Id, here is another one:
>>
>> "SmartWi - Multi Room Solution is a Smart Card Reader hardware device. This
>> driver was developed by SmartWi International A/S. The hardware id of this
>> driver is USB/VID_1234&PID_1234."
>>
>> found by googling vid_1234&pid_1234.
>>
>> There are others like 1234:5678 which also looks suspicious.
> 
> Yeah, this is a "fake" number, which happens a lot (0000/0000 is also
> used.)
> 
> Because of this, I don't know if we should take this change.  It
> obviously fixes an issue for _this_ device, but for any other
> usb-storage device using this fake id, will it cause issues?
> 
> thanks,
> 
> greg k-h


If you are asking me then I say that the patch should not be taken.
If the manufacturer doesn't make it possible to distinguish this USB 
device from another USB device then there is nothing we can do for him.


thanks
Lars