Re: uhid: broken interface: 32/64-bit compatibility

Re: uhid: broken interface: 32/64-bit compatibility

[David Herrmann]

Hi Kirill

On Fri, Feb 15, 2013 at 12:29 PM, Kirill A. Shutemov
<kirill.shutemov@linux.intel.com> wrote:
> Hi David and all,
>
> There's claim in uhid.h that the interface is "compatible even between
> architectures". But it obviously is not true: struct uhid_create_req
> contains pointer which breaks everything.
>
> The easy way to demonstrate the issue is compile uhid-example.c with -m32
> and try to run it on 64 bit kernel. Creating of the device will fail.

Indeed, we missed that. We should probably also notify the HIDP
developers as "struct hidp_connadd_req" suffers from the same
problems. (CC'ed)

> I don't see an easy way to fix this. Few options:
>
> 1. Replace the pointer with u64. It will fix the issue, but it breaks ABI
>    which is never a good idea. Not sure how many users interface already
>    has.

The only users I am aware of is an HID debugging tool and experimental
HoG Bluetooth support (bluez). Maybe Marcel or Johan can comment
whether this is already used by bluez-5? If it is, then we shouldn't
break ABI and go with #2+#3. Otherwise, I think changing to u64 should
be ok.
On the other hand, it would break any future build for older stable
kernels so not breaking ABI is probably the best idea. Any comments? I
can add a COMPAT fix and a comment to fix this in the next version of
UHID_CREATE.

Thanks!
David

Re: uhid: broken interface: 32/64-bit compatibility

[Johan Hedberg]

Hi David,

On Fri, Feb 15, 2013, David Herrmann wrote:
> On Fri, Feb 15, 2013 at 12:29 PM, Kirill A. Shutemov
> <kirill.shutemov@linux.intel.com> wrote:
> > Hi David and all,
> >
> > There's claim in uhid.h that the interface is "compatible even between
> > architectures". But it obviously is not true: struct uhid_create_req
> > contains pointer which breaks everything.
> >
> > The easy way to demonstrate the issue is compile uhid-example.c with -m32
> > and try to run it on 64 bit kernel. Creating of the device will fail.
> 
> Indeed, we missed that. We should probably also notify the HIDP
> developers as "struct hidp_connadd_req" suffers from the same
> problems. (CC'ed)
> 
> > I don't see an easy way to fix this. Few options:
> >
> > 1. Replace the pointer with u64. It will fix the issue, but it breaks ABI
> >    which is never a good idea. Not sure how many users interface already
> >    has.
> 
> The only users I am aware of is an HID debugging tool and experimental
> HoG Bluetooth support (bluez). Maybe Marcel or Johan can comment
> whether this is already used by bluez-5? If it is, then we shouldn't
> break ABI and go with #2+#3. Otherwise, I think changing to u64 should
> be ok.
> On the other hand, it would break any future build for older stable
> kernels so not breaking ABI is probably the best idea. Any comments? I
> can add a COMPAT fix and a comment to fix this in the next version of
> UHID_CREATE.

The HoG code in BlueZ 5 does indeed use this API and it's also not
anymore behind any kind of experimental flag (i.e. it is an officially
supported feature).

Johan

Re: uhid: broken interface: 32/64-bit compatibility

[Kirill A. Shutemov]

Johan Hedberg wrote:
> Hi David,
> 
> On Fri, Feb 15, 2013, David Herrmann wrote:
> > On Fri, Feb 15, 2013 at 12:29 PM, Kirill A. Shutemov
> > <kirill.shutemov@linux.intel.com> wrote:
> > > Hi David and all,
> > >
> > > There's claim in uhid.h that the interface is "compatible even between
> > > architectures". But it obviously is not true: struct uhid_create_req
> > > contains pointer which breaks everything.
> > >
> > > The easy way to demonstrate the issue is compile uhid-example.c with -m32
> > > and try to run it on 64 bit kernel. Creating of the device will fail.
> > 
> > Indeed, we missed that. We should probably also notify the HIDP
> > developers as "struct hidp_connadd_req" suffers from the same
> > problems. (CC'ed)
> > 
> > > I don't see an easy way to fix this. Few options:
> > >
> > > 1. Replace the pointer with u64. It will fix the issue, but it breaks ABI
> > >    which is never a good idea. Not sure how many users interface already
> > >    has.
> > 
> > The only users I am aware of is an HID debugging tool and experimental
> > HoG Bluetooth support (bluez). Maybe Marcel or Johan can comment
> > whether this is already used by bluez-5? If it is, then we shouldn't
> > break ABI and go with #2+#3. Otherwise, I think changing to u64 should
> > be ok.
> > On the other hand, it would break any future build for older stable
> > kernels so not breaking ABI is probably the best idea. Any comments? I
> > can add a COMPAT fix and a comment to fix this in the next version of
> > UHID_CREATE.
> 
> The HoG code in BlueZ 5 does indeed use this API and it's also not
> anymore behind any kind of experimental flag (i.e. it is an officially
> supported feature).
> 
> Johan

Here's my attempt to fix the issue.

Not sure if tricks with padding in a good idea. We can  just use __u64
instead of pointer, but it will require update of userspace to silence
cast warning and will cause warning if you will try to use updated
userspace with old kernel headers.

Any comments?

>From 0a0989cf08952464f8cab73d066beb876ff42949 Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Date: Fri, 15 Feb 2013 15:33:59 +0200
Subject: [PATCH] uhid: introduce new create event to fix 32/64-bit
 compatibility issue

Current create event has pointer in payload. It causes problem with
32/64-bit compatibility. In particular it's not possible to use 32-bit
userspace driver with 64-bit kernel.

This patch deprecates old create event and introduce a new one. The new
create event has padding for pointer on 32-bit system to extend pointer
correctly.

Old userspace driver binaries will use old create event. It requires
simple recompile to switch to new one.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
---
 drivers/hid/uhid.c        |   31 +++++++++++++++++++++++++++++++
 include/uapi/linux/uhid.h |   24 +++++++++++++++++++++++-
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 714cd8c..2f0b0e4 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -343,6 +343,34 @@ err_free:
 	return ret;
 }
 
+static int uhid_dev_old_create(struct uhid_device *uhid,
+		struct uhid_event *ev)
+{
+	struct uhid_event *new;
+
+	new = kzalloc(sizeof(new), GFP_KERNEL);
+	if (!new)
+		return -ENOMEM;
+
+	new->type = UHID_CREATE;
+	memcpy(new->u.create.name, ev->u.old_create.name, 128);
+	memcpy(new->u.create.phys, ev->u.old_create.phys, 64);
+	memcpy(new->u.create.uniq, ev->u.old_create.uniq, 64);
+
+	/* Assume kernel and userspace bitness are the same */
+	new->u.create.rd_data = ev->u.old_create.rd_data;
+
+	new->u.create.rd_size = ev->u.old_create.rd_size;
+	new->u.create.bus = ev->u.old_create.bus;
+	new->u.create.vendor = ev->u.old_create.vendor;
+	new->u.create.product = ev->u.old_create.product;
+	new->u.create.version = ev->u.old_create.version;
+	new->u.create.country = ev->u.old_create.country;
+	memcpy(ev, new, sizeof(new));
+	kfree(new);
+	return uhid_dev_create(uhid, ev);
+}
+
 static int uhid_dev_destroy(struct uhid_device *uhid)
 {
 	if (!uhid->running)
@@ -507,6 +535,9 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
 	case UHID_CREATE:
 		ret = uhid_dev_create(uhid, &uhid->input_buf);
 		break;
+	case UHID_OLD_CREATE:
+		ret = uhid_dev_old_create(uhid, &uhid->input_buf);
+		break;
 	case UHID_DESTROY:
 		ret = uhid_dev_destroy(uhid);
 		break;
diff --git a/include/uapi/linux/uhid.h b/include/uapi/linux/uhid.h
index 9c6974f..bb18be8 100644
--- a/include/uapi/linux/uhid.h
+++ b/include/uapi/linux/uhid.h
@@ -23,7 +23,7 @@
 #include <linux/types.h>
 
 enum uhid_event_type {
-	UHID_CREATE,
+	UHID_OLD_CREATE,
 	UHID_DESTROY,
 	UHID_START,
 	UHID_STOP,
@@ -34,13 +34,34 @@ enum uhid_event_type {
 	UHID_INPUT,
 	UHID_FEATURE,
 	UHID_FEATURE_ANSWER,
+	UHID_CREATE,
 };
 
+struct uhid_old_create_req {
+	__u8 name[128];
+	__u8 phys[64];
+	__u8 uniq[64];
+	__u8 __user *rd_data;
+	__u16 rd_size;
+
+	__u16 bus;
+	__u32 vendor;
+	__u32 product;
+	__u32 version;
+	__u32 country;
+} __attribute__((__packed__));
+
 struct uhid_create_req {
 	__u8 name[128];
 	__u8 phys[64];
 	__u8 uniq[64];
+#if __BITS_PER_LONG != 64 && __BYTE_ORDER == __BIG_ENDIAN
+	__u32 __pad;
+#endif
 	__u8 __user *rd_data;
+#if __BITS_PER_LONG != 64 && __BYTE_ORDER == __LITTLE_ENDIAN
+	__u32 __pad;
+#endif
 	__u16 rd_size;
 
 	__u16 bus;
@@ -92,6 +113,7 @@ struct uhid_event {
 	__u32 type;
 
 	union {
+		struct uhid_old_create_req old_create;
 		struct uhid_create_req create;
 		struct uhid_input_req input;
 		struct uhid_output_req output;
-- 
 Kirill A. Shutemov

Re: uhid: broken interface: 32/64-bit compatibility

[Andy Shevchenko]

> Any comments?

Generic comments.  Could you use *_compat instead of  *_old_*?
Another idea is do not touch current interface, just append new
function and associated structure to make a smooth transition of the
userspace stuff.

What about documentation (Documentation/hid/uhid.txt)? Could you
update it acordingly?

> Subject: [PATCH] uhid: introduce new create event to fix 32/64-bit
>  compatibility issue
>
> Current create event has pointer in payload. It causes problem with
> 32/64-bit compatibility. In particular it's not possible to use 32-bit
> userspace driver with 64-bit kernel.


> This patch deprecates old create event and introduce a new one. The new
> create event has padding for pointer on 32-bit system to extend pointer
> correctly.
>
> Old userspace driver binaries will use old create event. It requires
> simple recompile to switch to new one.

That's what I afraid of. Better to try to avoid any excessive
requirement to the existing userspace.

-- 
With Best Regards,
Andy Shevchenko

Re: uhid: broken interface: 32/64-bit compatibility

[Dmitry Torokhov]

On Fri, Feb 15, 2013 at 03:51:41PM +0200, Kirill A. Shutemov wrote:
> Johan Hedberg wrote:
> > Hi David,
> > 
> > On Fri, Feb 15, 2013, David Herrmann wrote:
> > > On Fri, Feb 15, 2013 at 12:29 PM, Kirill A. Shutemov
> > > <kirill.shutemov@linux.intel.com> wrote:
> > > > Hi David and all,
> > > >
> > > > There's claim in uhid.h that the interface is "compatible even between
> > > > architectures". But it obviously is not true: struct uhid_create_req
> > > > contains pointer which breaks everything.
> > > >
> > > > The easy way to demonstrate the issue is compile uhid-example.c with -m32
> > > > and try to run it on 64 bit kernel. Creating of the device will fail.
> > > 
> > > Indeed, we missed that. We should probably also notify the HIDP
> > > developers as "struct hidp_connadd_req" suffers from the same
> > > problems. (CC'ed)
> > > 
> > > > I don't see an easy way to fix this. Few options:
> > > >
> > > > 1. Replace the pointer with u64. It will fix the issue, but it breaks ABI
> > > >    which is never a good idea. Not sure how many users interface already
> > > >    has.
> > > 
> > > The only users I am aware of is an HID debugging tool and experimental
> > > HoG Bluetooth support (bluez). Maybe Marcel or Johan can comment
> > > whether this is already used by bluez-5? If it is, then we shouldn't
> > > break ABI and go with #2+#3. Otherwise, I think changing to u64 should
> > > be ok.
> > > On the other hand, it would break any future build for older stable
> > > kernels so not breaking ABI is probably the best idea. Any comments? I
> > > can add a COMPAT fix and a comment to fix this in the next version of
> > > UHID_CREATE.
> > 
> > The HoG code in BlueZ 5 does indeed use this API and it's also not
> > anymore behind any kind of experimental flag (i.e. it is an officially
> > supported feature).
> > 
> > Johan
> 
> Here's my attempt to fix the issue.
> 
> Not sure if tricks with padding in a good idea. We can  just use __u64
> instead of pointer, but it will require update of userspace to silence
> cast warning and will cause warning if you will try to use updated
> userspace with old kernel headers.
> 
> Any comments?

This does not fix anything really, we simply have to deal with compat
interface.

Compiled but not tested.

Thanks.

-- 
Dmitry

UHID: make creating devices work on 64/32 systems

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Unfortunately UHID interface, as it was introduced, is broken with 32 bit
userspace running on 64 bit kernels as it uses a pointer in its userspace
facing API.

Fix it by checking if we are executing compat task and munge the request
appropriately.

Reported-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/hid/uhid.c |   95 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 92 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 714cd8c..fc307e0 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/atomic.h>
+#include <linux/compat.h>
 #include <linux/device.h>
 #include <linux/fs.h>
 #include <linux/hid.h>
@@ -276,6 +277,94 @@ static struct hid_ll_driver uhid_hid_driver = {
 	.parse = uhid_hid_parse,
 };
 
+#ifdef CONFIG_COMPAT
+
+/* Apparently we haven't stepped on these rakes enough times yet. */
+struct uhid_create_req_compat {
+	__u8 name[128];
+	__u8 phys[64];
+	__u8 uniq[64];
+
+	compat_uptr_t rd_data;
+	__u16 rd_size;
+
+	__u16 bus;
+	__u32 vendor;
+	__u32 product;
+	__u32 version;
+	__u32 country;
+} __attribute__((__packed__));
+
+static int uhid_event_from_user(const char __user *buffer, size_t len,
+				struct uhid_event *event)
+{
+	if (is_compat_task()) {
+		u32 type;
+
+		if (get_user(type, buffer))
+			return -EFAULT;
+
+		if (type == UHID_CREATE) {
+			/*
+			 * This is our messed up request with compat pointer.
+			 * It is largish (more than 256 bytes) so we better
+			 * allocate it from the heap.
+			 */
+			struct uhid_create_req_compat *compat;
+
+			compat = kmalloc(sizeof(*compat), GFP_KERNEL);
+			if (!compat)
+				return -ENOMEM;
+
+			buffer += sizeof(type);
+			len -= sizeof(type);
+			if (copy_from_user(compat, buffer,
+					   min(len, sizeof(*compat)))) {
+				kfree(compat);
+				return -EFAULT;
+			}
+
+			/* Shuffle the data over to proper structure */
+			event->type = type;
+
+			memcpy(event->u.create.name, compat->name,
+				sizeof(compat->name));
+			memcpy(event->u.create.phys, compat->phys,
+				sizeof(compat->phys));
+			memcpy(event->u.create.uniq, compat->uniq,
+				sizeof(compat->uniq));
+
+			event->u.create.rd_data = compat_ptr(compat->rd_data);
+			event->u.create.rd_size = compat->rd_size;
+
+			event->u.create.bus = compat->bus;
+			event->u.create.vendor = compat->vendor;
+			event->u.create.product = compat->product;
+			event->u.create.version = compat->version;
+			event->u.create.country = compat->country;
+
+			kfree(compat);
+			return 0;
+		}
+		/* All others can be copied directly */
+	}
+
+	if (copy_from_user(event, buffer, min(len, sizeof(*event))))
+		return -EFAULT;
+
+	return 0;
+}
+#else
+static int uhid_event_from_user(const char __user *buffer, size_t len,
+				struct uhid_event *event)
+{
+	if (copy_from_user(event, buffer, min(len, sizeof(*event))))
+		return -EFAULT;
+
+	return 0;
+}
+#endif
+
 static int uhid_dev_create(struct uhid_device *uhid,
 			   const struct uhid_event *ev)
 {
@@ -498,10 +587,10 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
 
 	memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
 	len = min(count, sizeof(uhid->input_buf));
-	if (copy_from_user(&uhid->input_buf, buffer, len)) {
-		ret = -EFAULT;
+
+	ret = uhid_event_from_user(buffer, len, &uhid->input_buf);
+	if (ret)
 		goto unlock;
-	}
 
 	switch (uhid->input_buf.type) {
 	case UHID_CREATE:

Re: uhid: broken interface: 32/64-bit compatibility

[Kirill A. Shutemov]

Dmitry Torokhov wrote:
> On Fri, Feb 15, 2013 at 03:51:41PM +0200, Kirill A. Shutemov wrote:
> > Johan Hedberg wrote:
> > > Hi David,
> > > 
> > > On Fri, Feb 15, 2013, David Herrmann wrote:
> > > > On Fri, Feb 15, 2013 at 12:29 PM, Kirill A. Shutemov
> > > > <kirill.shutemov@linux.intel.com> wrote:
> > > > > Hi David and all,
> > > > >
> > > > > There's claim in uhid.h that the interface is "compatible even between
> > > > > architectures". But it obviously is not true: struct uhid_create_req
> > > > > contains pointer which breaks everything.
> > > > >
> > > > > The easy way to demonstrate the issue is compile uhid-example.c with -m32
> > > > > and try to run it on 64 bit kernel. Creating of the device will fail.
> > > > 
> > > > Indeed, we missed that. We should probably also notify the HIDP
> > > > developers as "struct hidp_connadd_req" suffers from the same
> > > > problems. (CC'ed)
> > > > 
> > > > > I don't see an easy way to fix this. Few options:
> > > > >
> > > > > 1. Replace the pointer with u64. It will fix the issue, but it breaks ABI
> > > > >    which is never a good idea. Not sure how many users interface already
> > > > >    has.
> > > > 
> > > > The only users I am aware of is an HID debugging tool and experimental
> > > > HoG Bluetooth support (bluez). Maybe Marcel or Johan can comment
> > > > whether this is already used by bluez-5? If it is, then we shouldn't
> > > > break ABI and go with #2+#3. Otherwise, I think changing to u64 should
> > > > be ok.
> > > > On the other hand, it would break any future build for older stable
> > > > kernels so not breaking ABI is probably the best idea. Any comments? I
> > > > can add a COMPAT fix and a comment to fix this in the next version of
> > > > UHID_CREATE.
> > > 
> > > The HoG code in BlueZ 5 does indeed use this API and it's also not
> > > anymore behind any kind of experimental flag (i.e. it is an officially
> > > supported feature).
> > > 
> > > Johan
> > 
> > Here's my attempt to fix the issue.
> > 
> > Not sure if tricks with padding in a good idea. We can  just use __u64
> > instead of pointer, but it will require update of userspace to silence
> > cast warning and will cause warning if you will try to use updated
> > userspace with old kernel headers.
> > 
> > Any comments?
> 
> This does not fix anything really, we simply have to deal with compat
> interface.
> 
> Compiled but not tested.

Works for me.

Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>

Comment in uhid.h about cross-arch compatibility should be
removed since it's false.

-- 
 Kirill A. Shutemov

Re: uhid: broken interface: 32/64-bit compatibility

[Jiri Kosina]

On Fri, 15 Feb 2013, Dmitry Torokhov wrote:

> > Here's my attempt to fix the issue.
> > 
> > Not sure if tricks with padding in a good idea. We can  just use __u64
> > instead of pointer, but it will require update of userspace to silence
> > cast warning and will cause warning if you will try to use updated
> > userspace with old kernel headers.
> > 
> > Any comments?
> 
> This does not fix anything really, we simply have to deal with compat
> interface.
> 
> Compiled but not tested.
> 
> Thanks.

Sorry for late response, I have been extremely busy doing some skiing :-)

Thanks a lot for fixing this embarassing bug, Dmitry. I have now applied 
the patch.

-- 
Jiri Kosina
SUSE Labs

Re: uhid: broken interface: 32/64-bit compatibility

[Dmitry Torokhov]

On Mon, Feb 18, 2013 at 11:28:40AM +0100, Jiri Kosina wrote:
> On Fri, 15 Feb 2013, Dmitry Torokhov wrote:
> 
> > > Here's my attempt to fix the issue.
> > > 
> > > Not sure if tricks with padding in a good idea. We can  just use __u64
> > > instead of pointer, but it will require update of userspace to silence
> > > cast warning and will cause warning if you will try to use updated
> > > userspace with old kernel headers.
> > > 
> > > Any comments?
> > 
> > This does not fix anything really, we simply have to deal with compat
> > interface.
> > 
> > Compiled but not tested.
> > 
> > Thanks.
> 
> Sorry for late response, I have been extremely busy doing some skiing :-)

Sounds good. At least someone has the right priorities ;)

-- 
Dmitry

Re: uhid: broken interface: 32/64-bit compatibility

[Dmitry Torokhov]

Hi David,

On Fri, Feb 15, 2013 at 12:46:55PM +0100, David Herrmann wrote:
> Hi Kirill
> 
> On Fri, Feb 15, 2013 at 12:29 PM, Kirill A. Shutemov
> <kirill.shutemov@linux.intel.com> wrote:
> > Hi David and all,
> >
> > There's claim in uhid.h that the interface is "compatible even between
> > architectures". But it obviously is not true: struct uhid_create_req
> > contains pointer which breaks everything.
> >
> > The easy way to demonstrate the issue is compile uhid-example.c with -m32
> > and try to run it on 64 bit kernel. Creating of the device will fail.
> 
> Indeed, we missed that. We should probably also notify the HIDP
> developers as "struct hidp_connadd_req" suffers from the same
> problems. (CC'ed)

I believe this issue has already been taken care of (see
compat_hidp_connadd_req and hidp_sock_compat_ioctl).

Thanks.

-- 
Dmitry