From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Alan Stern <stern@rowland.harvard.edu>,
syzbot+72af3105289dcb4c055b@syzkaller.appspotmail.com,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>,
linux-usb@vger.kernel.org
Subject: [PATCH AUTOSEL 5.13 06/21] USB: core: Fix incorrect pipe calculation in do_proc_control()
Date: Tue, 27 Jul 2021 09:18:53 -0400 [thread overview]
Message-ID: <20210727131908.834086-6-sashal@kernel.org> (raw)
In-Reply-To: <20210727131908.834086-1-sashal@kernel.org>
From: Alan Stern <stern@rowland.harvard.edu>
[ Upstream commit b0863f1927323110e3d0d69f6adb6a91018a9a3c ]
When the user submits a control URB via usbfs, the user supplies the
bRequestType value and the kernel uses it to compute the pipe value.
However, do_proc_control() performs this computation incorrectly in
the case where the bRequestType direction bit is set to USB_DIR_IN and
the URB's transfer length is 0: The pipe's direction is also set to IN
but it should be OUT, which is the direction the actual transfer will
use regardless of bRequestType.
Commit 5cc59c418fde ("USB: core: WARN if pipe direction != setup
packet direction") added a check to compare the direction bit in the
pipe value to a control URB's actual direction and to WARN if they are
different. This can be triggered by the incorrect computation
mentioned above, as found by syzbot.
This patch fixes the computation, thus avoiding the WARNing.
Reported-and-tested-by: syzbot+72af3105289dcb4c055b@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20210712185436.GB326369@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/devio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 2218941d35a3..73b60f013b20 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1133,7 +1133,7 @@ static int do_proc_control(struct usb_dev_state *ps,
"wIndex=%04x wLength=%04x\n",
ctrl->bRequestType, ctrl->bRequest, ctrl->wValue,
ctrl->wIndex, ctrl->wLength);
- if (ctrl->bRequestType & 0x80) {
+ if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength) {
pipe = usb_rcvctrlpipe(dev, 0);
snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT, NULL, 0);
--
2.30.2
next prev parent reply other threads:[~2021-07-27 13:20 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-27 13:18 [PATCH AUTOSEL 5.13 01/21] regulator: rtmv20: Fix wrong mask for strobe-polarity-high Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 02/21] regulator: rt5033: Fix n_voltages settings for BUCK and LDO Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 03/21] spi: stm32h7: fix full duplex irq handler handling Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 04/21] ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 05/21] regulator: mtk-dvfsrc: Fix wrong dev pointer for devm_regulator_register Sasha Levin
2021-07-27 13:18 ` Sasha Levin [this message]
2021-07-27 13:28 ` [PATCH AUTOSEL 5.13 06/21] USB: core: Fix incorrect pipe calculation in do_proc_control() Greg Kroah-Hartman
2021-07-27 18:54 ` Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 07/21] r8152: Fix potential PM refcount imbalance Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 08/21] r8152: Fix a deadlock by doubly PM resume Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 09/21] qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union() Sasha Levin
2021-07-27 13:30 ` Justin He
2021-07-27 18:54 ` Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 10/21] ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 11/21] mt7530 fix mt7530_fdb_write vid missing ivl bit Sasha Levin
2021-07-27 13:18 ` [PATCH AUTOSEL 5.13 12/21] net: Fix zero-copy head len calculation Sasha Levin
2021-07-27 13:19 ` [PATCH AUTOSEL 5.13 13/21] ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during startup Sasha Levin
2021-07-27 13:19 ` [PATCH AUTOSEL 5.13 14/21] ASoC: ti: j721e-evm: Check for not initialized parent_clk_id Sasha Levin
2021-07-27 13:19 ` [PATCH AUTOSEL 5.13 15/21] efi/mokvar: Reserve the table only if it is in boot services data Sasha Levin
2021-07-27 13:19 ` [PATCH AUTOSEL 5.13 16/21] nvme: fix nvme_setup_command metadata trace event Sasha Levin
2021-07-27 13:19 ` [PATCH AUTOSEL 5.13 17/21] drm/amd/display: Fix comparison error in dcn21 DML Sasha Levin
2021-07-27 13:19 ` [PATCH AUTOSEL 5.13 18/21] drm/amd/display: Fix max vstartup calculation for modes with borders Sasha Levin
2021-07-27 13:19 ` [PATCH AUTOSEL 5.13 19/21] io_uring: never attempt iopoll reissue from release path Sasha Levin
2021-07-27 13:19 ` [PATCH AUTOSEL 5.13 20/21] io_uring: explicitly catch any illegal async queue attempt Sasha Levin
2021-07-27 13:19 ` [PATCH AUTOSEL 5.13 21/21] ACPI: fix NULL pointer dereference Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210727131908.834086-6-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+72af3105289dcb4c055b@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).