Re: WARNING in usb_submit_urb

[Oliver Neukum]

Am Donnerstag, den 09.11.2017, 13:19 +0100 schrieb Andrey Konovalov:
> 
> This isn't the "BOGUS urb xfer" warning, this is "BOGUS urb flags". So
> 2 means the URB_ISO_ASAP flag, which is passed in urb->transfer_flags
> but not allowed. And as far as I understand, it gets set because uurb
> (which is passed from user space) has USBDEVFS_URB_ISO_ASAP flag set
> when passed to proc_do_submiturb().

Hi,

yes we should filter better.
Could you test?

	Regards
		Oliver
From 6026435970e0d34def0abc71879bbd6fea6e8ec1 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@xxxxxxxx>
Date: Thu, 9 Nov 2017 14:18:32 +0100
Subject: [PATCH] USB: usbfs: Filter flags passed in from user space

USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints.
Improve sanity checking.

Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx>
---
 drivers/usb/core/devio.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index c3aaafc25a04..abe6457516a2 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1473,6 +1473,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
 	case USBDEVFS_URB_TYPE_CONTROL:
 		if (!usb_endpoint_xfer_control(&ep->desc))
 			return -EINVAL;
+		if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
+			return -EINVAL;
 		/* min 8 byte setup packet */
 		if (uurb->buffer_length < 8)
 			return -EINVAL;
@@ -1511,6 +1513,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
 		break;
 
 	case USBDEVFS_URB_TYPE_BULK:
+		if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
+			return -EINVAL;
 		switch (usb_endpoint_type(&ep->desc)) {
 		case USB_ENDPOINT_XFER_CONTROL:
 		case USB_ENDPOINT_XFER_ISOC:
-- 
2.13.6