linux-kernel - Re: [PATCH v2] usb: gadget: Set self-powered based on MaxPower and bmAttributes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a882365c-148c-410a-ac67-b7a17dafc501@ijzerbout.nl>
Date: Fri, 21 Feb 2025 20:26:49 +0100
From: Kees Bakker <kees@...erbout.nl>
To: Prashanth K <prashanth.k@....qualcomm.com>
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
 stable@...r.kernel.org, Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Thinh Nguyen <Thinh.Nguyen@...opsys.com>,
 Peter Korsgaard <peter@...sgaard.com>,
 Sabyrzhan Tasbolatov <snovitoll@...il.com>
Subject: Re: [PATCH v2] usb: gadget: Set self-powered based on MaxPower and
 bmAttributes

Op 17-02-2025 om 13:03 schreef Prashanth K:
> Currently the USB gadget will be set as bus-powered based solely
> on whether its bMaxPower is greater than 100mA, but this may miss
> devices that may legitimately draw less than 100mA but still want
> to report as bus-powered. Similarly during suspend & resume, USB
> gadget is incorrectly marked as bus/self powered without checking
> the bmAttributes field. Fix these by configuring the USB gadget
> as self or bus powered based on bmAttributes, and explicitly set
> it as bus-powered if it draws more than 100mA.
>
> Cc: stable@...r.kernel.org
> Fixes: 5e5caf4fa8d3 ("usb: gadget: composite: Inform controller driver of self-powered")
> Signed-off-by: Prashanth K <prashanth.k@....qualcomm.com>
> ---
> Changes in v2:
> - Didn't change anything from RFC.
> - Link to RFC: https://lore.kernel.org/all/20250204105908.2255686-1-prashanth.k@oss.qualcomm.com/
>
>   drivers/usb/gadget/composite.c | 16 +++++++++++-----
>   1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
> index bdda8c74602d..1fb28bbf6c45 100644
> --- a/drivers/usb/gadget/composite.c
> +++ b/drivers/usb/gadget/composite.c
> @@ -1050,10 +1050,11 @@ static int set_config(struct usb_composite_dev *cdev,
>   	else
>   		usb_gadget_set_remote_wakeup(gadget, 0);
>   done:
> -	if (power <= USB_SELF_POWER_VBUS_MAX_DRAW)
> -		usb_gadget_set_selfpowered(gadget);
> -	else
> +	if (power > USB_SELF_POWER_VBUS_MAX_DRAW ||
> +	    !(c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))
Please check this change again. From line 983-884 there is a `goto done`.
in case `c` is NULL. So, there will be a potential NULL pointer dereference
with your change.
>   		usb_gadget_clear_selfpowered(gadget);
> +	else
> +		usb_gadget_set_selfpowered(gadget);
>   
>   	usb_gadget_vbus_draw(gadget, power);
>   	if (result >= 0 && cdev->delayed_status)
> [...]