linux-kernel - Re: [PATCH] USB: OHCI/UHCI: Add soft dependencies on ehci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0c85d288-405f-4aaf-944e-b1d452d0f275@rowland.harvard.edu>
Date: Wed, 31 Dec 2025 10:20:56 -0500
From: Alan Stern <stern@...land.harvard.edu>
To: Huacai Chen <chenhuacai@...nel.org>
Cc: Diederik de Haas <diederik@...ow-tech.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Huacai Chen <chenhuacai@...ngson.cn>, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Shengwen Xiao <atzlinux@...a.com>,
	linux-rockchip@...ts.infradead.org
Subject: Re: [PATCH] USB: OHCI/UHCI: Add soft dependencies on ehci_hcd

On Wed, Dec 31, 2025 at 05:38:05PM +0800, Huacai Chen wrote:
> From your long explanation I think the order is still important. "New
> connection" may be harmless for USB keyboard/mouse, but really
> unacceptable for USB storage.
> 
> If we revert 05c92da0c524 and 9beeee6584b9, the real problem doesn't
> disappear. Then we go back to pre-2008 to rely on distributions
> providing a correct modprobe.conf?

The warning message in 9beeee6584b9 was written a long time ago; back 
then I didn't realize that the real dependency was between the -pci 
drivers rather than the -hcd ones (and I wasn't aware of softdeps).  The 
soft dependency in 05c92da0c524 is between the -pci drivers, so it is 
correct.

To put it another way, on PCI-based systems it is not a problem if the 
modules are loaded in this order: uhci-hcd, ohci-hcd, ehci-hcd, 
ehci-pci, ohci-pci, uhci-pci.  Even though the warning message would be 
logged, the message would be wrong.

On the whole, I think the best approach is to revert 9beeee6584b9's 
warning message while keeping 05c92da0c524's softdeps.  Greg might not 
approve of soft dependencies between modules in general, but in this 
case I believe it is appropriate.

And so your patch really is not needed, as far as I can tell.  While it 
might in theory help some peculiar platform-dependent scenario, I'm 
not aware of any platforms like that.

Alan Stern