Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 24 Aug 2021 13:53:56 +0200 (CEST)
From:   Jiri Kosina <jikos@kernel.org>
To:     Alan Stern <stern@rowland.harvard.edu>
cc:     syzbot <syzbot+9b57a46bf1801ce2a2ca@syzkaller.appspotmail.com>,
        benjamin.tissoires@redhat.com, linux-input@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
        mkubecek@suse.cz, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] WARNING in hid_submit_ctrl/usb_submit_urb
In-Reply-To: <20210820140620.GA35867@rowland.harvard.edu>
Message-ID: <nycvar.YFH.7.76.2108241351490.15313@cbobk.fhfr.pm>
References: <20210819195300.GA8613@rowland.harvard.edu> <000000000000c322ab05c9f2e880@google.com> <20210820140620.GA35867@rowland.harvard.edu>
User-Agent: Alpine 2.21 (LSU 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk

On Fri, 20 Aug 2021, Alan Stern wrote:

> > syzbot has tested the proposed patch and the reproducer did not trigger any issue:
> 
> That's good to know.  Still, I suspect there's a better way of handling 
> this condition.
> 
> In particular, does it make sense to accept descriptors for input or 
> feature reports with length zero?  I can't imagine what good such 
> reports would do.

I quickly went through drivers + some hidraw users, and can't spot any use 
case for it.

> On the other hand, I'm not familiar enough with the code to know the 
> right way to reject these descriptors and reports.  It looks like the 
> HID subsystem was not designed with this sort of check in mind.
> 
> Benjamin and Jiri, what do you think?  Is it okay to allow descriptors 
> for zero-length reports and just pretend they have length 1 (as the 
> patch tested by syzbot did), or should we instead reject them during 
> probing?

I think it's a good band-aid for 5.14 (or 5.14-stable if we don't make 
it), and if it turns out to break something (which I don't expect), than 
we can look into rejecting already during probe.

Benjamin, is there a way to run this quickly through your HID regression 
testing machinery?

Thanks,

-- 
Jiri Kosina
SUSE Labs