linux-kernel - Re: [PATCH] media: usb: siano: fix endpoint checks in smsusb_init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 3 May 2024 15:52:10 -0700
From: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To: Mauro Carvalho Chehab <mchehab@...nel.org>
CC: Hans Verkuil <hverkuil-cisco@...all.nl>, Dongliang Mu <dzm91@...t.edu.cn>,
	Andrew Morton <akpm@...ux-foundation.org>, Alan Stern
	<stern@...land.harvard.edu>, <linux-media@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>,
	<syzbot+12002a39b8c60510f8fb@...kaller.appspotmail.com>
Subject: Re: [PATCH] media: usb: siano: fix endpoint checks in
 smsusb_init_device()

Hi

On 5/3/24 14:20, Mauro Carvalho Chehab wrote:
> Em Fri, 3 May 2024 09:14:37 -0700
> Nikita Zhandarovich <n.zhandarovich@...tech.ru> escreveu:
> 
>>> Did you test it on what devices? I'm not sure if all siano devices
>>> are bulk. Why did you decide to use usb_endpoint_is_bulk_(in|out)
>>> instead of usb_endpoint_dir_(in|out)?  
>>
>> I did not have the hardware required to test it properly, I'm afraid.
>> I made sure to point that out in the patch description.
>>
>> As for siano devices possibly having different endpoints type apart from
>> bulk, I was relying on the rest of the driver code to determine just
>> that (which is maybe somewhat flawed in this case). 
> 
> Most digital TV devices also have ISOC endpoints. I'm not sure about
> Siano.
After a quick glance at Siano driver I am not sure about that being true
specifically for Siano devices just yet, but I understand your point
nonetheless.
> 
>> Since
>> smsusb_submit_urb() (and some other functions like usb_rcvbulkpipe())
>> works exclusively with bulk types, I did not feel the need to even
>> expect int types, for instance.
> 
> The problem is not with int endpoints. Most media devices have isoc
> endpoints. There are even cases that different device models supported
> by the same driver have some bulk and some isoc endpoints. See em28xx 
> driver for instance: most devices are isoc only; some have both isoc
> and bulk; a few have just bulk.
> 
> In the specific case of siano, it supports 3 generations of devices
> (sms1000, sms11xx, sms22xx), each with several submodels. 
> Those 3 generations have different specs, and sms1000 even have one
> "boot" USB ID, and one "warm" USB ID, each one with different endpoints.
> 
> That's basically why I'm afraid of a patch like this could cause
> regressions if not properly tested, as it is changing the logic
> from just detecting the direction to also validate if the endpoint
> is not isoc.

Thank you for being so thorough with your answer. I think I
overestimated how much I should trust current driver implementation. I
should be (at least, in this case) looking at what hardware expects of
the driver.

Let me try to do a little more research into smsxxxx specs and maybe see
about getting my hands on some actual devices for testing.

> 
> Regards,
> Mauro

With regards,
Nikita