DriverDev-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found
@ 2020-10-09 16:20 Anant Thazhemadam
  2020-10-10  7:00 ` Greg Kroah-Hartman
  0 siblings, 1 reply; 7+ messages in thread
From: Anant Thazhemadam @ 2020-10-09 16:20 UTC (permalink / raw)
  Cc: devel, Anant Thazhemadam, Greg Kroah-Hartman, linux-kernel,
	Ian Abbott, syzbot+009f546aa1370056b1c2, linux-kernel-mentees

While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if 
wMaxPacketSize = 0 for the endpoints found.

Some devices have isochronous endpoints that have wMaxPacketSize = 0
(as required by the USB-2 spec).
However, since this doesn't apply here, wMaxPacketSize = 0 can be
considered to be invalid.

Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
---
The error (as detected by syzbot) is generated in 
vmk80xx_write_packet() (which is called in vmk80xx_reset_device()) when
it tries to assign devpriv->usb_tx_buf[0] = cmd.

This NULL pointer dereference issue arises because
size = usb_endpoint_maxp(devpriv->ep_tx) = 0.

This can be traced back to vmk80xx_find_usb_endpoints(), where the usb 
endpoints are found, and assigned accordingly.
(For some more insight, in vmk80xx_find_usb_endpoints(), 
if one of intf->cur_altsetting->iface_desc->endpoints' desc value = 0, 
and consequently this endpoint is assigned to devpriv->ep_tx,
this issue gets triggered.)

Checking if the wMaxPacketSize of an endpoint is invalid and returning
an error value accordingly, seems to fix the error.

We could also alternatively perform this checking (if the size is 0 or not) 
in vmk80xx_reset_device() itself, but it only seemed like covering up the issue
at that place, rather than fixing it, so I wasn't sure that was any better.

However, if I'm not wrong, this might end up causing the probe to fail, and I'm 
not sure if that's the right thing to do in cases like this, and if it isn't I'd
like some input on what exactly is the required course of action in cases like this.

 drivers/staging/comedi/drivers/vmk80xx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 65dc6c51037e..cb0a965d3c37 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -667,6 +667,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev)
 	if (!devpriv->ep_rx || !devpriv->ep_tx)
 		return -ENODEV;
 
+	if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx))
+		return -EINVAL;
+
 	return 0;
 }
 
-- 
2.25.1

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found
  2020-10-10  7:00 ` Greg Kroah-Hartman
@ 2020-10-10  1:59   ` Anant Thazhemadam
  2020-10-10  8:09     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 7+ messages in thread
From: Anant Thazhemadam @ 2020-10-10  1:59 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: devel, syzbot+009f546aa1370056b1c2, Ian Abbott,
	linux-kernel-mentees, linux-kernel

Hi,

On 10-10-2020 12:30, Greg Kroah-Hartman wrote:
> On Fri, Oct 09, 2020 at 09:50:29PM +0530, Anant Thazhemadam wrote:
>> While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if 
>> wMaxPacketSize = 0 for the endpoints found.
>>
>> Some devices have isochronous endpoints that have wMaxPacketSize = 0
>> (as required by the USB-2 spec).
>> However, since this doesn't apply here, wMaxPacketSize = 0 can be
>> considered to be invalid.
>>
>> Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
>> Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
>> Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
>> ---
> You sent 2 patches with the same subject, which one is the "latest" one?

This patch (that you have replied to) is the "latest" one.

> Please always version your patches and put below the --- line what
> changed from the previous version, so that maintainers have a chance to
> know which to accept...

The other patch (with the same subject line) wasn't supposed to be sent out.
I realized there was a coding style error in that while sending, and cancelled
sending it, but it got sent nonetheless.
I would have included a v2 tag in this patch itself, but I didn't realize that the
previous one got sent until afterwards. :(
I'm sorry for that.

> Can you fix this up and send a v3?

Shouldn't I resend this patch as a v2 instead? Since there wouldn't be any
changes from v2 (this patch) to v3 otherwise (unless of course, somebody could
suggest some more changes that could be made to this patch itself).

Thanks,
Anant




_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found
  2020-10-09 16:20 [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found Anant Thazhemadam
@ 2020-10-10  7:00 ` Greg Kroah-Hartman
  2020-10-10  1:59   ` Anant Thazhemadam
  0 siblings, 1 reply; 7+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-10  7:00 UTC (permalink / raw)
  To: Anant Thazhemadam
  Cc: devel, syzbot+009f546aa1370056b1c2, Ian Abbott,
	linux-kernel-mentees, linux-kernel

On Fri, Oct 09, 2020 at 09:50:29PM +0530, Anant Thazhemadam wrote:
> While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if 
> wMaxPacketSize = 0 for the endpoints found.
> 
> Some devices have isochronous endpoints that have wMaxPacketSize = 0
> (as required by the USB-2 spec).
> However, since this doesn't apply here, wMaxPacketSize = 0 can be
> considered to be invalid.
> 
> Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
> Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
> Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
> ---

You sent 2 patches with the same subject, which one is the "latest" one?
Please always version your patches and put below the --- line what
changed from the previous version, so that maintainers have a chance to
know which to accept...

Can you fix this up and send a v3?

thanks,
greg k-h
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found
  2020-10-10  1:59   ` Anant Thazhemadam
@ 2020-10-10  8:09     ` Greg Kroah-Hartman
  2020-10-10  8:26       ` Anant Thazhemadam
  0 siblings, 1 reply; 7+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-10  8:09 UTC (permalink / raw)
  To: Anant Thazhemadam
  Cc: devel, syzbot+009f546aa1370056b1c2, Ian Abbott,
	linux-kernel-mentees, linux-kernel

On Sat, Oct 10, 2020 at 07:29:13AM +0530, Anant Thazhemadam wrote:
> Hi,
> 
> On 10-10-2020 12:30, Greg Kroah-Hartman wrote:
> > On Fri, Oct 09, 2020 at 09:50:29PM +0530, Anant Thazhemadam wrote:
> >> While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if 
> >> wMaxPacketSize = 0 for the endpoints found.
> >>
> >> Some devices have isochronous endpoints that have wMaxPacketSize = 0
> >> (as required by the USB-2 spec).
> >> However, since this doesn't apply here, wMaxPacketSize = 0 can be
> >> considered to be invalid.
> >>
> >> Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
> >> Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
> >> Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
> >> ---
> > You sent 2 patches with the same subject, which one is the "latest" one?
> 
> This patch (that you have replied to) is the "latest" one.
> 
> > Please always version your patches and put below the --- line what
> > changed from the previous version, so that maintainers have a chance to
> > know which to accept...
> 
> The other patch (with the same subject line) wasn't supposed to be sent out.
> I realized there was a coding style error in that while sending, and cancelled
> sending it, but it got sent nonetheless.
> I would have included a v2 tag in this patch itself, but I didn't realize that the
> previous one got sent until afterwards. :(
> I'm sorry for that.
> 
> > Can you fix this up and send a v3?
> 
> Shouldn't I resend this patch as a v2 instead? Since there wouldn't be any
> changes from v2 (this patch) to v3 otherwise (unless of course, somebody could
> suggest some more changes that could be made to this patch itself).

The change would be that you are correctly listing the version
information, so it would be v3 :)

thanks,

greg k-h
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found
  2020-10-10  8:09     ` Greg Kroah-Hartman
@ 2020-10-10  8:26       ` Anant Thazhemadam
  0 siblings, 0 replies; 7+ messages in thread
From: Anant Thazhemadam @ 2020-10-10  8:26 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: devel, syzbot+009f546aa1370056b1c2, Ian Abbott,
	linux-kernel-mentees, linux-kernel


On 10/10/20 1:39 pm, Greg Kroah-Hartman wrote:
> On Sat, Oct 10, 2020 at 07:29:13AM +0530, Anant Thazhemadam wrote:
>> Hi,
>>
>> On 10-10-2020 12:30, Greg Kroah-Hartman wrote:
>>> On Fri, Oct 09, 2020 at 09:50:29PM +0530, Anant Thazhemadam wrote:
>>>> While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if 
>>>> wMaxPacketSize = 0 for the endpoints found.
>>>>
>>>> Some devices have isochronous endpoints that have wMaxPacketSize = 0
>>>> (as required by the USB-2 spec).
>>>> However, since this doesn't apply here, wMaxPacketSize = 0 can be
>>>> considered to be invalid.
>>>>
>>>> Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
>>>> Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
>>>> Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
>>>> ---
>>> You sent 2 patches with the same subject, which one is the "latest" one?
>> This patch (that you have replied to) is the "latest" one.
>>
>>> Please always version your patches and put below the --- line what
>>> changed from the previous version, so that maintainers have a chance to
>>> know which to accept...
>> The other patch (with the same subject line) wasn't supposed to be sent out.
>> I realized there was a coding style error in that while sending, and cancelled
>> sending it, but it got sent nonetheless.
>> I would have included a v2 tag in this patch itself, but I didn't realize that the
>> previous one got sent until afterwards. :(
>> I'm sorry for that.
>>
>>> Can you fix this up and send a v3?
>> Shouldn't I resend this patch as a v2 instead? Since there wouldn't be any
>> changes from v2 (this patch) to v3 otherwise (unless of course, somebody could
>> suggest some more changes that could be made to this patch itself).
> The change would be that you are correctly listing the version
> information, so it would be v3 :)
>
Understood, thank you. I will send in a v3 as advised. :)

Thanks,
Anant

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found
  2020-10-09 16:16 Anant Thazhemadam
@ 2020-10-09 16:24 ` Anant Thazhemadam
  0 siblings, 0 replies; 7+ messages in thread
From: Anant Thazhemadam @ 2020-10-09 16:24 UTC (permalink / raw)
  Cc: devel, syzbot+009f546aa1370056b1c2, linux-kernel, Ian Abbott,
	Greg Kroah-Hartman, linux-kernel-mentees


On 09/10/20 9:46 pm, Anant Thazhemadam wrote:
> While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if 
> wMaxPacketSize = 0 for the endpoints found.
>
> Some devices have isochronous endpoints that have wMaxPacketSize = 0
> (as required by the USB-2 spec).
> However, since this doesn't apply here, wMaxPacketSize = 0 can be
> considered to be invalid.
>
> Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
> Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
> Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
> ---
> The error (as detected by syzbot) is generated in 
> vmk80xx_write_packet() (which is called in vmk80xx_reset_device()) when
> it tries to assign devpriv->usb_tx_buf[0] = cmd.
>
> This NULL pointer dereference issue arises because
> size = usb_endpoint_maxp(devpriv->ep_tx) = 0.
>
> This can be traced back to vmk80xx_find_usb_endpoints(), where the usb 
> endpoints are found, and assigned accordingly.
> (For some more insight, in vmk80xx_find_usb_endpoints(), 
> if one of intf->cur_altsetting->iface_desc->endpoints' desc value = 0, 
> and consequently this endpoint is assigned to devpriv->ep_tx,
> this issue gets triggered.)
>
> Checking if the wMaxPacketSize of an endpoint is invalid and returning
> an error value accordingly, seems to fix the error.
>
> We could also alternatively perform this checking (if the size is 0 or not) 
> in vmk80xx_reset_device() itself, but it only seemed like covering up the issue
> at that place, rather than fixing it, so I wasn't sure that was any better.
>
> However, if I'm not wrong, this might end up causing the probe to fail, and I'm 
> not sure if that's the right thing to do in cases like this, and if it isn't I'd
> like some input on what exactly is the required course of action in cases like this.
>
>  drivers/staging/comedi/drivers/vmk80xx.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
> index 65dc6c51037e..cb0a965d3c37 100644
> --- a/drivers/staging/comedi/drivers/vmk80xx.c
> +++ b/drivers/staging/comedi/drivers/vmk80xx.c
> @@ -667,6 +667,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev)
>  	if (!devpriv->ep_rx || !devpriv->ep_tx)
>  		return -ENODEV;
>  
> +	if(!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx))
> +		return -EINVAL;
> +
>  	return 0;
>  }
>  

The patch in this mail has a coding style issue (that I thought I had fixed), and was sent out by
mistake.
Please ignore this mail. Apologies.

Thanks,
Anant
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found
@ 2020-10-09 16:16 Anant Thazhemadam
  2020-10-09 16:24 ` Anant Thazhemadam
  0 siblings, 1 reply; 7+ messages in thread
From: Anant Thazhemadam @ 2020-10-09 16:16 UTC (permalink / raw)
  Cc: devel, Anant Thazhemadam, Greg Kroah-Hartman, linux-kernel,
	Ian Abbott, syzbot+009f546aa1370056b1c2, linux-kernel-mentees

While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if 
wMaxPacketSize = 0 for the endpoints found.

Some devices have isochronous endpoints that have wMaxPacketSize = 0
(as required by the USB-2 spec).
However, since this doesn't apply here, wMaxPacketSize = 0 can be
considered to be invalid.

Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
---
The error (as detected by syzbot) is generated in 
vmk80xx_write_packet() (which is called in vmk80xx_reset_device()) when
it tries to assign devpriv->usb_tx_buf[0] = cmd.

This NULL pointer dereference issue arises because
size = usb_endpoint_maxp(devpriv->ep_tx) = 0.

This can be traced back to vmk80xx_find_usb_endpoints(), where the usb 
endpoints are found, and assigned accordingly.
(For some more insight, in vmk80xx_find_usb_endpoints(), 
if one of intf->cur_altsetting->iface_desc->endpoints' desc value = 0, 
and consequently this endpoint is assigned to devpriv->ep_tx,
this issue gets triggered.)

Checking if the wMaxPacketSize of an endpoint is invalid and returning
an error value accordingly, seems to fix the error.

We could also alternatively perform this checking (if the size is 0 or not) 
in vmk80xx_reset_device() itself, but it only seemed like covering up the issue
at that place, rather than fixing it, so I wasn't sure that was any better.

However, if I'm not wrong, this might end up causing the probe to fail, and I'm 
not sure if that's the right thing to do in cases like this, and if it isn't I'd
like some input on what exactly is the required course of action in cases like this.

 drivers/staging/comedi/drivers/vmk80xx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 65dc6c51037e..cb0a965d3c37 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -667,6 +667,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev)
 	if (!devpriv->ep_rx || !devpriv->ep_tx)
 		return -ENODEV;
 
+	if(!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx))
+		return -EINVAL;
+
 	return 0;
 }
 
-- 
2.25.1

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, back to index

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-09 16:20 [PATCH] staging: comedi: check validity of wMaxPacketSize of usb endpoints found Anant Thazhemadam
2020-10-10  7:00 ` Greg Kroah-Hartman
2020-10-10  1:59   ` Anant Thazhemadam
2020-10-10  8:09     ` Greg Kroah-Hartman
2020-10-10  8:26       ` Anant Thazhemadam
  -- strict thread matches above, loose matches on Subject: below --
2020-10-09 16:16 Anant Thazhemadam
2020-10-09 16:24 ` Anant Thazhemadam

DriverDev-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/driverdev-devel/0 driverdev-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 driverdev-devel driverdev-devel/ https://lore.kernel.org/driverdev-devel \
		driverdev-devel@linuxdriverproject.org devel@driverdev.osuosl.org
	public-inbox-index driverdev-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.linuxdriverproject.driverdev-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git