From: Sasha Levin <sashal@kernel.org>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Alan Stern <stern@rowland.harvard.edu>,
syzbot+72af3105289dcb4c055b@syzkaller.appspotmail.com,
linux-usb@vger.kernel.org
Subject: Re: [PATCH AUTOSEL 5.13 06/21] USB: core: Fix incorrect pipe calculation in do_proc_control()
Date: Tue, 27 Jul 2021 14:54:08 -0400 [thread overview]
Message-ID: <YQBWUG0w/5FB7a7S@sashalap> (raw)
In-Reply-To: <YQAJ9LzK8S7tJqwR@kroah.com>
On Tue, Jul 27, 2021 at 03:28:20PM +0200, Greg Kroah-Hartman wrote:
>On Tue, Jul 27, 2021 at 09:18:53AM -0400, Sasha Levin wrote:
>> From: Alan Stern <stern@rowland.harvard.edu>
>>
>> [ Upstream commit b0863f1927323110e3d0d69f6adb6a91018a9a3c ]
>>
>> When the user submits a control URB via usbfs, the user supplies the
>> bRequestType value and the kernel uses it to compute the pipe value.
>> However, do_proc_control() performs this computation incorrectly in
>> the case where the bRequestType direction bit is set to USB_DIR_IN and
>> the URB's transfer length is 0: The pipe's direction is also set to IN
>> but it should be OUT, which is the direction the actual transfer will
>> use regardless of bRequestType.
>>
>> Commit 5cc59c418fde ("USB: core: WARN if pipe direction != setup
>> packet direction") added a check to compare the direction bit in the
>> pipe value to a control URB's actual direction and to WARN if they are
>> different. This can be triggered by the incorrect computation
>> mentioned above, as found by syzbot.
>>
>> This patch fixes the computation, thus avoiding the WARNing.
>>
>> Reported-and-tested-by: syzbot+72af3105289dcb4c055b@syzkaller.appspotmail.com
>> Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
>> Link: https://lore.kernel.org/r/20210712185436.GB326369@rowland.harvard.edu
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> ---
>> drivers/usb/core/devio.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
>> index 2218941d35a3..73b60f013b20 100644
>> --- a/drivers/usb/core/devio.c
>> +++ b/drivers/usb/core/devio.c
>> @@ -1133,7 +1133,7 @@ static int do_proc_control(struct usb_dev_state *ps,
>> "wIndex=%04x wLength=%04x\n",
>> ctrl->bRequestType, ctrl->bRequest, ctrl->wValue,
>> ctrl->wIndex, ctrl->wLength);
>> - if (ctrl->bRequestType & 0x80) {
>> + if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength) {
>> pipe = usb_rcvctrlpipe(dev, 0);
>> snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT, NULL, 0);
>>
>> --
>> 2.30.2
>>
>
>This is not needed in any kernel that does not also have 5cc59c418fde
>("USB: core: WARN if pipe direction != setup packet direction"), which
>showed up in 5.14-rc1, so please drop this from all of the AUTOSEL
>trees.
Will do, thanks!
--
Thanks,
Sasha
next prev parent reply other threads:[~2021-07-27 18:54 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20210727131908.834086-1-sashal@kernel.org>
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 06/21] USB: core: Fix incorrect pipe calculation in do_proc_control() Sasha Levin
2021-07-27 13:28 ` Greg Kroah-Hartman
2021-07-27 18:54 ` Sasha Levin [this message]
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 07/21] r8152: Fix potential PM refcount imbalance Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 08/21] r8152: Fix a deadlock by doubly PM resume Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YQBWUG0w/5FB7a7S@sashalap \
--to=sashal@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+72af3105289dcb4c055b@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).