From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752632AbdKIPaf (ORCPT ); Thu, 9 Nov 2017 10:30:35 -0500 Received: from iolanthe.rowland.org ([192.131.102.54]:55148 "HELO iolanthe.rowland.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1751348AbdKIPae (ORCPT ); Thu, 9 Nov 2017 10:30:34 -0500 Date: Thu, 9 Nov 2017 10:30:33 -0500 (EST) From: Alan Stern X-X-Sender: stern@iolanthe.rowland.org To: Oliver Neukum cc: Andrey Konovalov , , , , Felipe Balbi , Greg KH , Takashi Iwai , syzbot , LKML , USB list Subject: Re: WARNING in usb_submit_urb In-Reply-To: <1510233974.2975.20.camel@suse.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 9 Nov 2017, Oliver Neukum wrote: > Am Donnerstag, den 09.11.2017, 13:19 +0100 schrieb Andrey Konovalov: > > > > This isn't the "BOGUS urb xfer" warning, this is "BOGUS urb flags". So > > 2 means the URB_ISO_ASAP flag, which is passed in urb->transfer_flags > > but not allowed. And as far as I understand, it gets set because uurb > > (which is passed from user space) has USBDEVFS_URB_ISO_ASAP flag set > > when passed to proc_do_submiturb(). > > Hi, > > yes we should filter better. > Could you test? > > Regards > Oliver > Subject: [PATCH] USB: usbfs: Filter flags passed in from user space > > USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints. > Improve sanity checking. > > Signed-off-by: Oliver Neukum > --- > drivers/usb/core/devio.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c > index c3aaafc25a04..abe6457516a2 100644 > --- a/drivers/usb/core/devio.c > +++ b/drivers/usb/core/devio.c > @@ -1473,6 +1473,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb > case USBDEVFS_URB_TYPE_CONTROL: > if (!usb_endpoint_xfer_control(&ep->desc)) > return -EINVAL; > + if (uurb->flags & USBDEVFS_URB_ISO_ASAP) > + return -EINVAL; > /* min 8 byte setup packet */ > if (uurb->buffer_length < 8) > return -EINVAL; > @@ -1511,6 +1513,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb > break; > > case USBDEVFS_URB_TYPE_BULK: > + if (uurb->flags & USBDEVFS_URB_ISO_ASAP) > + return -EINVAL; > switch (usb_endpoint_type(&ep->desc)) { > case USB_ENDPOINT_XFER_CONTROL: > case USB_ENDPOINT_XFER_ISOC: You need to check interrupt URBs also. It would be best to have a single test before the big "switch" statement: if ((uurb->flags & USBDEVFS_URB_ISO_ASAP) && uurb->type != USBDEVFS_URB_TYPE_ISOCHRONOUS) return -EINVAL; Alan Stern