diff for duplicates of <1394712342-15778-365-Taiwan-albertk@realtek.com>
diff --git a/a/1.txt b/N1/1.txt
index 5409cdd..d39ece0 100644
--- a/a/1.txt
+++ b/N1/1.txt
@@ -1,45 +1,107 @@
-For certain platforms, it causes USB reset periodically.
+Verify some fields of the USB descriptor to make sure the driver
+could be used by the device.
+Besides, remove the check of endpoint number in rtl8152_probe().
+usb_find_common_endpoints() includes it.
+
+BugLink: https://syzkaller.appspot.com/bug?id=912c9c373656996801b4de61f1e3cb326fe940aa
+Reported-by: syzbot+95afd23673f5dd295c57@syzkaller.appspotmail.com
+Fixes: c2198943e33b ("r8152: search the configuration of vendor mode")
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
---
- drivers/net/usb/r8152.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
+v3:
+Remove the check of endpoint number in rtl_check_vendor_ok().
+
+Adjust the error message and ccommit message.
+
+v2:
+Use usb_find_common_endpoints() and usb_endpoint_num() to replace original
+code.
+
+remove the check of endpoint number in rtl8152_probe(). It has been done
+in rtl_check_vendor_ok().
+
+ drivers/net/usb/r8152.c | 42 ++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 37 insertions(+), 5 deletions(-)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 7efeddad1fc8..b1a00f29455b 100644
+index 136ea06540ff..f6abb2fbf972 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
-@@ -3391,7 +3391,8 @@ static void rtl8153b_runtime_enable(struct r8152 *tp, bool enable)
- r8153b_ups_en(tp, false);
- r8153_queue_wake(tp, false);
- rtl_runtime_suspend_enable(tp, false);
-- r8153b_u1u2en(tp, true);
-+ if (tp->udev->speed != USB_SPEED_HIGH)
-+ r8153b_u1u2en(tp, true);
- }
+@@ -8107,6 +8107,37 @@ static void r8156b_init(struct r8152 *tp)
+ tp->coalesce = 15000; /* 15 us */
}
-@@ -5024,7 +5025,9 @@ static void rtl8153b_up(struct r8152 *tp)
- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, ocp_data);
-
- r8153_aldps_en(tp, true);
-- r8153b_u1u2en(tp, true);
++static bool rtl_check_vendor_ok(struct usb_interface *intf)
++{
++ struct usb_host_interface *alt = intf->cur_altsetting;
++ struct usb_endpoint_descriptor *in, *out, *intr;
+
-+ if (tp->udev->speed != USB_SPEED_HIGH)
-+ r8153b_u1u2en(tp, true);
- }
++ if (usb_find_common_endpoints(alt, &in, &out, &intr, NULL) < 0) {
++ dev_err(&intf->dev, "Expected endpoints are not found\n");
++ return false;
++ }
++
++ /* Check Rx endpoint address */
++ if (usb_endpoint_num(in) != 1) {
++ dev_err(&intf->dev, "Invalid Rx endpoint address\n");
++ return false;
++ }
++
++ /* Check Tx endpoint address */
++ if (usb_endpoint_num(out) != 2) {
++ dev_err(&intf->dev, "Invalid Tx endpoint address\n");
++ return false;
++ }
++
++ /* Check interrupt endpoint address */
++ if (usb_endpoint_num(intr) != 3) {
++ dev_err(&intf->dev, "Invalid interrupt endpoint address\n");
++ return false;
++ }
++
++ return true;
++}
++
+ static bool rtl_vendor_mode(struct usb_interface *intf)
+ {
+ struct usb_host_interface *alt = intf->cur_altsetting;
+@@ -8115,12 +8146,15 @@ static bool rtl_vendor_mode(struct usb_interface *intf)
+ int i, num_configs;
- static void rtl8153b_down(struct r8152 *tp)
-@@ -5527,7 +5530,9 @@ static void r8153b_init(struct r8152 *tp)
- ocp_data &= ~CUR_LINK_OK;
- ocp_data |= POLL_LINK_CHG;
- ocp_write_word(tp, MCU_TYPE_PLA, PLA_EXTRA_STATUS, ocp_data);
-- r8153b_u1u2en(tp, true);
+ if (alt->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC)
+- return true;
++ return rtl_check_vendor_ok(intf);
+
+ /* The vendor mode is not always config #1, so to find it out. */
+ udev = interface_to_usbdev(intf);
+ c = udev->config;
+ num_configs = udev->descriptor.bNumConfigurations;
++ if (num_configs < 2)
++ return false;
+
-+ if (tp->udev->speed != USB_SPEED_HIGH)
-+ r8153b_u1u2en(tp, true);
- usb_enable_lpm(tp->udev);
+ for (i = 0; i < num_configs; (i++, c++)) {
+ struct usb_interface_descriptor *desc = NULL;
+
+@@ -8135,7 +8169,8 @@ static bool rtl_vendor_mode(struct usb_interface *intf)
+ }
+ }
+
+- WARN_ON_ONCE(i == num_configs);
++ if (i == num_configs)
++ dev_err(&intf->dev, "Unexpected Device\n");
+
+ return false;
+ }
+@@ -9381,9 +9416,6 @@ static int rtl8152_probe(struct usb_interface *intf,
+ if (!rtl_vendor_mode(intf))
+ return -ENODEV;
- /* MAC clock speed down */
+- if (intf->cur_altsetting->desc.bNumEndpoints < 3)
+- return -ENODEV;
+-
+ usb_reset_device(udev);
+ netdev = alloc_etherdev(sizeof(struct r8152));
+ if (!netdev) {
--
-2.21.0
\ No newline at end of file
+2.26.3
\ No newline at end of file
diff --git a/a/content_digest b/N1/content_digest
index 53e9c34..bdad982 100644
--- a/a/content_digest
+++ b/N1/content_digest
@@ -1,28 +1,26 @@
[
- "ref\0001394712342-15778-338-Taiwan-albertk\@realtek.com\0"
-]
-[
- "ref\0001394712342-15778-358-Taiwan-albertk\@realtek.com\0"
+ "ref\0001394712342-15778-363-Taiwan-albertk\@realtek.com\0"
]
[
"From\0Hayes Wang <hayeswang\@realtek.com>\0"
]
[
- "Subject\0[PATCH net v3 7/9] r8152: don't enable U1U2 with USB_SPEED_HIGH for RTL8153B\0"
+ "Subject\0[PATCH net v3] r8152: check the informaton of the device\0"
]
[
- "Date\0Wed, 22 Jan 2020 16:02:11 +0800\0"
+ "Date\0Mon, 24 May 2021 14:49:42 +0800\0"
]
[
- "To\0<netdev\@vger.kernel.org>\0"
+ "To\0<kuba\@kernel.org>",
+ " <davem\@davemloft.net>\0"
]
[
- "Cc\0<nic_swsd\@realtek.com>",
+ "Cc\0<netdev\@vger.kernel.org>",
+ " <nic_swsd\@realtek.com>",
" <linux-kernel\@vger.kernel.org>",
" <linux-usb\@vger.kernel.org>",
- " <pmalani\@chromium.org>",
- " <grundler\@chromium.org>",
- " Hayes Wang <hayeswang\@realtek.com>\0"
+ " Hayes Wang <hayeswang\@realtek.com>",
+ " <syzbot+95afd23673f5dd295c57\@syzkaller.appspotmail.com>\0"
]
[
"\0000:1\0"
@@ -31,51 +29,113 @@
"b\0"
]
[
- "For certain platforms, it causes USB reset periodically.\n",
+ "Verify some fields of the USB descriptor to make sure the driver\n",
+ "could be used by the device.\n",
+ "\n",
+ "Besides, remove the check of endpoint number in rtl8152_probe().\n",
+ "usb_find_common_endpoints() includes it.\n",
"\n",
+ "BugLink: https://syzkaller.appspot.com/bug?id=912c9c373656996801b4de61f1e3cb326fe940aa\n",
+ "Reported-by: syzbot+95afd23673f5dd295c57\@syzkaller.appspotmail.com\n",
+ "Fixes: c2198943e33b (\"r8152: search the configuration of vendor mode\")\n",
"Signed-off-by: Hayes Wang <hayeswang\@realtek.com>\n",
"---\n",
- " drivers/net/usb/r8152.c | 11 ++++++++---\n",
- " 1 file changed, 8 insertions(+), 3 deletions(-)\n",
+ "v3:\n",
+ "Remove the check of endpoint number in rtl_check_vendor_ok().\n",
+ "\n",
+ "Adjust the error message and ccommit message.\n",
+ "\n",
+ "v2:\n",
+ "Use usb_find_common_endpoints() and usb_endpoint_num() to replace original\n",
+ "code.\n",
+ "\n",
+ "remove the check of endpoint number in rtl8152_probe(). It has been done\n",
+ "in rtl_check_vendor_ok().\n",
+ "\n",
+ " drivers/net/usb/r8152.c | 42 ++++++++++++++++++++++++++++++++++++-----\n",
+ " 1 file changed, 37 insertions(+), 5 deletions(-)\n",
"\n",
"diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c\n",
- "index 7efeddad1fc8..b1a00f29455b 100644\n",
+ "index 136ea06540ff..f6abb2fbf972 100644\n",
"--- a/drivers/net/usb/r8152.c\n",
"+++ b/drivers/net/usb/r8152.c\n",
- "\@\@ -3391,7 +3391,8 \@\@ static void rtl8153b_runtime_enable(struct r8152 *tp, bool enable)\n",
- " \t\tr8153b_ups_en(tp, false);\n",
- " \t\tr8153_queue_wake(tp, false);\n",
- " \t\trtl_runtime_suspend_enable(tp, false);\n",
- "-\t\tr8153b_u1u2en(tp, true);\n",
- "+\t\tif (tp->udev->speed != USB_SPEED_HIGH)\n",
- "+\t\t\tr8153b_u1u2en(tp, true);\n",
- " \t}\n",
+ "\@\@ -8107,6 +8107,37 \@\@ static void r8156b_init(struct r8152 *tp)\n",
+ " \ttp->coalesce = 15000;\t/* 15 us */\n",
" }\n",
" \n",
- "\@\@ -5024,7 +5025,9 \@\@ static void rtl8153b_up(struct r8152 *tp)\n",
- " \tocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, ocp_data);\n",
- " \n",
- " \tr8153_aldps_en(tp, true);\n",
- "-\tr8153b_u1u2en(tp, true);\n",
+ "+static bool rtl_check_vendor_ok(struct usb_interface *intf)\n",
+ "+{\n",
+ "+\tstruct usb_host_interface *alt = intf->cur_altsetting;\n",
+ "+\tstruct usb_endpoint_descriptor *in, *out, *intr;\n",
"+\n",
- "+\tif (tp->udev->speed != USB_SPEED_HIGH)\n",
- "+\t\tr8153b_u1u2en(tp, true);\n",
- " }\n",
+ "+\tif (usb_find_common_endpoints(alt, &in, &out, &intr, NULL) < 0) {\n",
+ "+\t\tdev_err(&intf->dev, \"Expected endpoints are not found\\n\");\n",
+ "+\t\treturn false;\n",
+ "+\t}\n",
+ "+\n",
+ "+\t/* Check Rx endpoint address */\n",
+ "+\tif (usb_endpoint_num(in) != 1) {\n",
+ "+\t\tdev_err(&intf->dev, \"Invalid Rx endpoint address\\n\");\n",
+ "+\t\treturn false;\n",
+ "+\t}\n",
+ "+\n",
+ "+\t/* Check Tx endpoint address */\n",
+ "+\tif (usb_endpoint_num(out) != 2) {\n",
+ "+\t\tdev_err(&intf->dev, \"Invalid Tx endpoint address\\n\");\n",
+ "+\t\treturn false;\n",
+ "+\t}\n",
+ "+\n",
+ "+\t/* Check interrupt endpoint address */\n",
+ "+\tif (usb_endpoint_num(intr) != 3) {\n",
+ "+\t\tdev_err(&intf->dev, \"Invalid interrupt endpoint address\\n\");\n",
+ "+\t\treturn false;\n",
+ "+\t}\n",
+ "+\n",
+ "+\treturn true;\n",
+ "+}\n",
+ "+\n",
+ " static bool rtl_vendor_mode(struct usb_interface *intf)\n",
+ " {\n",
+ " \tstruct usb_host_interface *alt = intf->cur_altsetting;\n",
+ "\@\@ -8115,12 +8146,15 \@\@ static bool rtl_vendor_mode(struct usb_interface *intf)\n",
+ " \tint i, num_configs;\n",
+ " \n",
+ " \tif (alt->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC)\n",
+ "-\t\treturn true;\n",
+ "+\t\treturn rtl_check_vendor_ok(intf);\n",
" \n",
- " static void rtl8153b_down(struct r8152 *tp)\n",
- "\@\@ -5527,7 +5530,9 \@\@ static void r8153b_init(struct r8152 *tp)\n",
- " \t\tocp_data &= ~CUR_LINK_OK;\n",
- " \tocp_data |= POLL_LINK_CHG;\n",
- " \tocp_write_word(tp, MCU_TYPE_PLA, PLA_EXTRA_STATUS, ocp_data);\n",
- "-\tr8153b_u1u2en(tp, true);\n",
+ " \t/* The vendor mode is not always config #1, so to find it out. */\n",
+ " \tudev = interface_to_usbdev(intf);\n",
+ " \tc = udev->config;\n",
+ " \tnum_configs = udev->descriptor.bNumConfigurations;\n",
+ "+\tif (num_configs < 2)\n",
+ "+\t\treturn false;\n",
"+\n",
- "+\tif (tp->udev->speed != USB_SPEED_HIGH)\n",
- "+\t\tr8153b_u1u2en(tp, true);\n",
- " \tusb_enable_lpm(tp->udev);\n",
+ " \tfor (i = 0; i < num_configs; (i++, c++)) {\n",
+ " \t\tstruct usb_interface_descriptor\t*desc = NULL;\n",
+ " \n",
+ "\@\@ -8135,7 +8169,8 \@\@ static bool rtl_vendor_mode(struct usb_interface *intf)\n",
+ " \t\t}\n",
+ " \t}\n",
+ " \n",
+ "-\tWARN_ON_ONCE(i == num_configs);\n",
+ "+\tif (i == num_configs)\n",
+ "+\t\tdev_err(&intf->dev, \"Unexpected Device\\n\");\n",
+ " \n",
+ " \treturn false;\n",
+ " }\n",
+ "\@\@ -9381,9 +9416,6 \@\@ static int rtl8152_probe(struct usb_interface *intf,\n",
+ " \tif (!rtl_vendor_mode(intf))\n",
+ " \t\treturn -ENODEV;\n",
" \n",
- " \t/* MAC clock speed down */\n",
+ "-\tif (intf->cur_altsetting->desc.bNumEndpoints < 3)\n",
+ "-\t\treturn -ENODEV;\n",
+ "-\n",
+ " \tusb_reset_device(udev);\n",
+ " \tnetdev = alloc_etherdev(sizeof(struct r8152));\n",
+ " \tif (!netdev) {\n",
"-- \n",
- "2.21.0"
+ "2.26.3"
]
-5d51a705d0decebd7e6b8182b086f3964123960a8f0bbb5b3387d6920bda1c11
+7b5a892fa2a9e9a90c4021da3b0fca574e3240dfb2b5e03aa237260c68b0094b
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).