Re: [PATCH] usb: interface: allow drivers declare number of endpoints they need

[Greg Kroah-Hartman]

On Mon, Nov 30, 2015 at 01:11:50PM -0800, Dmitry Torokhov wrote:
> USB interface drivers need to check number of endpoints before trying to
> access/use them. Quite a few drivers only use the default setting
> (altsetting 0), so let's allow them to declare number of endpoints in
> altsetting 0 they require to operate and have USB core check it for us
> instead of having every driver implement check manually.
> 
> For compatibility, if driver does not specify number of endpoints (i.e.
> number of endpoints is left at 0) we bypass the check in USB core and
> expect the driver perform necessary checks on its own.
> 
> Acked-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
> ---
> 
> Greg, if the patch is reasonable I wonder if I can take it through my
> tree, as I have a few drivers that do not check number of endpoints
> properly and will crash the kernel when specially crafted device is
> plugged in, as reported by Vladis Dronov.
> 
>  drivers/usb/core/driver.c | 9 +++++++++
>  include/linux/usb.h       | 7 +++++++
>  2 files changed, 16 insertions(+)
> 
> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
> index 6b5063e..d9f680d 100644
> --- a/drivers/usb/core/driver.c
> +++ b/drivers/usb/core/driver.c
> @@ -306,6 +306,15 @@ static int usb_probe_interface(struct device *dev)
>  
>  	dev_dbg(dev, "%s - got id\n", __func__);
>  
> +	if (driver->num_endpoints &&
> +	    intf->altsetting[0].desc.bNumEndpoints < driver->num_endpoints) {
> +

Empty line :(

> +		dev_err(dev, "Not enough endpoints %d (want %d)\n",
> +			intf->altsetting[0].desc.bNumEndpoints,
> +			driver->num_endpoints);

What can a user do with this?

> +		return -EINVAL;
> +	}
> +
>  	error = usb_autoresume_device(udev);
>  	if (error)
>  		return error;
> diff --git a/include/linux/usb.h b/include/linux/usb.h
> index 447fe29..93f8dfc 100644
> --- a/include/linux/usb.h
> +++ b/include/linux/usb.h
> @@ -1051,6 +1051,11 @@ struct usbdrv_wrap {
>   * @id_table: USB drivers use ID table to support hotplugging.
>   *	Export this with MODULE_DEVICE_TABLE(usb,...).  This must be set
>   *	or your driver's probe function will never get called.
> + * @num_endpoints: Number of endpoints that should be present in default
> + *	setting (altsetting 0) the driver needs to operate properly.
> + *	The probe will be aborted if actual number of endpoints is less
> + *	than what the driver specified here. 0 means no check should be
> + *	performed.

I don't understand, a driver can do whatever it wants with the endpoints
of the interface, why do we need to check/know this ahead of time?  What
is crashing without this?

It's up to the driver to check this, if it cares about it.  How many
drivers do you have that is going to care?  Why is this suddenly a new
thing that we haven't run into in the past 15+ years?

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/