linux-kernel - Re: [PATCH] USB: serial: Change usb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Zqo6aBRw15Rf_3Gh@hovoldconsulting.com>
Date: Wed, 31 Jul 2024 15:21:44 +0200
From: Johan Hovold <johan@...nel.org>
To: Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>
Cc: linux-kernel@...r.kernel.org,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	"open list:USB SERIAL SUBSYSTEM" <linux-usb@...r.kernel.org>
Subject: Re: [PATCH] USB: serial: Change usb_debug to not echo by default

On Mon, Jul 15, 2024 at 12:44:53PM +0200, Marek Marczykowski-Górecki wrote:
> This driver is intended as a "client" end of the console connection.
> When connected to a host it's supposed to receive debug logs, and
> possibly allow to interact with whatever debug console is available
> there. Feeding messages back, depending on a configuration may cause log
> messages be executed as shell commands (which can be really bad if one
> is unlucky, imagine a log message like "prevented running `rm -rf
> /home`").

This should not be an issue as canonical input is also enabled by
default (and as long as no one outputs random commands like that on a
single line).

> In case of Xen, it exposes sysrq-like debug interface, and
> feeding it its own logs will pretty quickly hit 'R' for "instant
> reboot".

But this sounds annoying enough.

> Contrary to a classic serial console, the USB one cannot be configured
> ahead of time, as the device shows up only when target OS is up. And at
> the time device is opened to execute relevant ioctl, it's already too
> late, especially when logs start flowing shortly after device is
> initialized.
> Avoid the issue by changing default to no echo for this type of devices.
> 
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>
> ---
>  drivers/usb/serial/usb_debug.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
> index 6934970f180d..91150c050637 100644
> --- a/drivers/usb/serial/usb_debug.c
> +++ b/drivers/usb/serial/usb_debug.c
> @@ -76,6 +76,11 @@ static void usb_debug_process_read_urb(struct urb *urb)
>  	usb_serial_generic_process_read_urb(urb);
>  }
>  
> +static void usb_debug_init_termios(struct tty_struct *tty)
> +{
> +	tty->termios.c_lflag &= ~ECHO;

I disabled echoing of newlines here as well when applying. Thanks.

Johan