From: Greg KH <greg@kroah.com>
To: Hayes Wang <hayeswang@realtek.com>
Cc: Alan Stern <stern@rowland.harvard.edu>,
syzbot <syzbot+95afd23673f5dd295c57@syzkaller.appspotmail.com>,
"davem@davemloft.net" <davem@davemloft.net>,
"kuba@kernel.org" <kuba@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"syzkaller-bugs@googlegroups.com"
<syzkaller-bugs@googlegroups.com>,
nic_swsd <nic_swsd@realtek.com>
Subject: Re: [syzbot] WARNING in rtl8152_probe
Date: Fri, 14 May 2021 10:26:51 +0200 [thread overview]
Message-ID: <YJ40S1eHnbg1dsYv@kroah.com> (raw)
In-Reply-To: <bddf302301f5420db0fa049c895c9b14@realtek.com>
On Fri, May 14, 2021 at 07:50:19AM +0000, Hayes Wang wrote:
> Greg KH <greg@kroah.com>
> > Sent: Friday, May 14, 2021 2:49 PM
> [...]
> > Because people can create "bad" devices and plug them into a system
> > which causes the driver to load and then potentially crash the system or
> > do other bad things.
> >
> > USB drivers now need to be able to handle "malicious" devices, it's been
> > that way for many years now.
>
> My question is that even I check whole the USB descriptor, the malicious
> devices could duplicate it easily to pass my checks. That is, I could add a
> lot of checks, but it still doesn't prevent malicious devices. Is this meaningful?
Checking the whole USB decriptor is fine, yes, they can duplicate that.
So that means you need to validate _ALL_ data coming from the device
that it is in an acceptable range of values that the driver can
correctly handle.
thanks,
greg k-h
next prev parent reply other threads:[~2021-05-14 8:26 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-12 9:40 [syzbot] WARNING in rtl8152_probe syzbot
2021-05-13 3:13 ` Hayes Wang
2021-05-13 14:25 ` Alan Stern
2021-05-14 2:58 ` Hayes Wang
2021-05-14 6:41 ` Dan Carpenter
2021-05-14 7:49 ` Hayes Wang
2021-05-14 6:48 ` Greg KH
2021-05-14 7:50 ` Hayes Wang
2021-05-14 8:26 ` Greg KH [this message]
2021-05-14 10:32 ` Hayes Wang
2021-05-14 15:32 ` Alan Stern
2021-05-17 1:01 ` Hayes Wang
2021-05-17 10:00 ` Oliver Neukum
2021-05-17 13:47 ` Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YJ40S1eHnbg1dsYv@kroah.com \
--to=greg@kroah.com \
--cc=davem@davemloft.net \
--cc=hayeswang@realtek.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nic_swsd@realtek.com \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+95afd23673f5dd295c57@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).