All of lore.kernel.org
 help / color / mirror / Atom feed
From: Oliver Neukum <oneukum@suse.com>
To: linux-usb@vger.kernel.org
Cc: Oliver Neukum <oneukum@suse.com>
Subject: [RFC 5/6] usb: usb_parse_endpoint must not count duplicated endpoints
Date: Thu, 11 Apr 2024 14:43:03 +0200	[thread overview]
Message-ID: <20240411124722.17343-6-oneukum@suse.com> (raw)
In-Reply-To: <20240411124722.17343-1-oneukum@suse.com>

When an interface is parsed the number of endpoints claimed to exist
is compared to the number of endpoint descriptors actually found.
Duplicated endpoints are not parsed in usb_parse_endpoint but
usb_parse_interface counts them. That makes no sense.
To correct this usb_parse_endpoint needs to return feedback
about the validity of parsed endpoints.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
 drivers/usb/core/config.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 055910fc6b19..50acc9021247 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -254,7 +254,7 @@ static bool config_endpoint_is_duplicate(struct usb_host_config *config,
 static int usb_parse_endpoint(struct device *ddev, int cfgno,
 		struct usb_host_config *config, int inum, int asnum,
 		struct usb_host_interface *ifp, int num_ep,
-		unsigned char *buffer, int size)
+		unsigned char *buffer, int size, bool *valid)
 {
 	struct usb_device *udev = to_usb_device(ddev);
 	unsigned char *buffer0 = buffer;
@@ -270,6 +270,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 
 	buffer += d->bLength;
 	size -= d->bLength;
+	*valid = false;
 
 	if (d->bDescriptorType != USB_DT_ENDPOINT)
 		goto skip_to_next_endpoint_or_interface_descriptor;
@@ -313,6 +314,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 		}
 	}
 
+	*valid = true;
 	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
 	++ifp->desc.bNumEndpoints;
 
@@ -581,14 +583,17 @@ static int usb_parse_interface(struct device *ddev, int cfgno,
 	/* Parse all the endpoint descriptors */
 	n = 0;
 	while (size >= sizeof(struct usb_descriptor_header)) { /* minimum length to get bDescriptorType */
+		bool valid;
+
 		if (((struct usb_descriptor_header *) buffer)->bDescriptorType
 		     == USB_DT_INTERFACE)
 			break;
 		retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum,
-				alt, num_ep, buffer, size);
+				alt, num_ep, buffer, size, &valid);
 		if (retval < 0)
 			return retval;
-		++n;
+		if (valid)
+			++n;
 
 		buffer += retval;
 		size -= retval;
-- 
2.44.0


  parent reply	other threads:[~2024-04-11 12:47 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-04-11 12:42 Hardening the parser during enumerations Oliver Neukum
2024-04-11 12:42 ` [RFC 1/6] usb: usb_parse_endpoint ignore reserved bits Oliver Neukum
2024-04-11 14:11   ` Greg KH
2024-04-11 14:27     ` Oliver Neukum
2024-04-11 14:58       ` Greg KH
2024-04-11 15:35   ` Alan Stern
2024-04-11 15:40     ` Oliver Neukum
2024-04-11 12:43 ` [RFC 2/6] usb: avoid overrunning a buffer in usb_parse_interface Oliver Neukum
2024-04-11 15:39   ` Alan Stern
2024-04-11 17:36     ` Alan Stern
2024-04-11 12:43 ` [RFC 3/6] usb: usb_parse_endpoint needs to guard against short descriptors Oliver Neukum
2024-04-11 15:57   ` Alan Stern
2024-04-11 12:43 ` [RFC 4/6] usb: usb_parse_endpoint guard against an incromprehensible preamble Oliver Neukum
2024-04-11 16:00   ` Alan Stern
2024-04-11 12:43 ` Oliver Neukum [this message]
2024-04-11 16:04   ` [RFC 5/6] usb: usb_parse_endpoint must not count duplicated endpoints Alan Stern
2024-04-11 12:43 ` [RFC 6/6] usb: config: find_next_descriptor can overflow buffer Oliver Neukum
2024-04-11 16:16   ` Alan Stern
2024-04-11 14:09 ` Hardening the parser during enumerations Greg KH
2024-04-11 15:37   ` Oliver Neukum
2024-04-12  7:54     ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240411124722.17343-6-oneukum@suse.com \
    --to=oneukum@suse.com \
    --cc=linux-usb@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.