From: Alan Stern <stern@rowland.harvard.edu>
To: syzbot <syzbot+9b57a46bf1801ce2a2ca@syzkaller.appspotmail.com>
Cc: benjamin.tissoires@redhat.com, jikos@kernel.org,
linux-input@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-usb@vger.kernel.org, mkubecek@suse.cz,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] WARNING in hid_submit_ctrl/usb_submit_urb
Date: Fri, 20 Aug 2021 10:06:20 -0400 [thread overview]
Message-ID: <20210820140620.GA35867@rowland.harvard.edu> (raw)
In-Reply-To: <000000000000c322ab05c9f2e880@google.com>
On Thu, Aug 19, 2021 at 05:40:07PM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
That's good to know. Still, I suspect there's a better way of handling
this condition.
In particular, does it make sense to accept descriptors for input or
feature reports with length zero? I can't imagine what good such
reports would do.
On the other hand, I'm not familiar enough with the code to know the
right way to reject these descriptors and reports. It looks like the
HID subsystem was not designed with this sort of check in mind.
Benjamin and Jiri, what do you think? Is it okay to allow descriptors
for zero-length reports and just pretend they have length 1 (as the
patch tested by syzbot did), or should we instead reject them during
probing?
Alan Stern
next prev parent reply other threads:[~2021-08-20 14:06 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-18 15:46 [syzbot] WARNING in hid_submit_ctrl/usb_submit_urb syzbot
2021-08-18 9:14 ` syzbot
2021-08-18 18:49 ` Alan Stern
2021-08-18 20:13 ` syzbot
2021-08-19 15:26 ` Alan Stern
2021-08-19 17:35 ` syzbot
2021-08-19 19:53 ` Alan Stern
2021-08-20 0:40 ` syzbot
2021-08-20 14:06 ` Alan Stern [this message]
2021-08-24 11:53 ` Jiri Kosina
2021-08-24 12:34 ` Benjamin Tissoires
2021-08-31 9:51 ` Benjamin Tissoires
2021-08-31 13:34 ` Alan Stern
2021-08-31 19:53 ` Jiri Kosina
2021-09-01 15:38 ` Alan Stern
2021-09-01 15:51 ` Michal Kubecek
2021-08-24 11:50 ` Michal Kubecek
2021-08-30 19:22 ` Oleksandr Natalenko
2021-08-18 19:01 ` Alan Stern
2021-08-18 19:39 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210820140620.GA35867@rowland.harvard.edu \
--to=stern@rowland.harvard.edu \
--cc=benjamin.tissoires@redhat.com \
--cc=jikos@kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mkubecek@suse.cz \
--cc=syzbot+9b57a46bf1801ce2a2ca@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).