Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 9 Nov 2017 10:30:33 -0500 (EST)
From:   Alan Stern <stern@rowland.harvard.edu>
To:     Oliver Neukum <oneukum@suse.com>
cc:     Andrey Konovalov <andreyknvl@google.com>,
        <vskrishn@codeaurora.org>, <krinkin.m.u@gmail.com>,
        <syzkaller-bugs@googlegroups.com>,
        Felipe Balbi <felipe.balbi@linux.intel.com>,
        Greg KH <gregkh@linuxfoundation.org>,
        Takashi Iwai <tiwai@suse.de>,
        syzbot 
        <bot+50d191d34989b5aa28596b0a2cb20c96f3ca4650@syzkaller.appspotmail.com>,
        LKML <linux-kernel@vger.kernel.org>,
        USB list <linux-usb@vger.kernel.org>
Subject: Re: WARNING in usb_submit_urb
In-Reply-To: <1510233974.2975.20.camel@suse.com>
Message-ID: <Pine.LNX.4.44L0.1711091026190.1357-100000@iolanthe.rowland.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, 9 Nov 2017, Oliver Neukum wrote:

> Am Donnerstag, den 09.11.2017, 13:19 +0100 schrieb Andrey Konovalov:
> > 
> > This isn't the "BOGUS urb xfer" warning, this is "BOGUS urb flags". So
> > 2 means the URB_ISO_ASAP flag, which is passed in urb->transfer_flags
> > but not allowed. And as far as I understand, it gets set because uurb
> > (which is passed from user space) has USBDEVFS_URB_ISO_ASAP flag set
> > when passed to proc_do_submiturb().
> 
> Hi,
> 
> yes we should filter better.
> Could you test?
> 
> 	Regards
> 		Oliver

> Subject: [PATCH] USB: usbfs: Filter flags passed in from user space
> 
> USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints.
> Improve sanity checking.
> 
> Signed-off-by: Oliver Neukum <oneukum@suse.com>
> ---
>  drivers/usb/core/devio.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
> index c3aaafc25a04..abe6457516a2 100644
> --- a/drivers/usb/core/devio.c
> +++ b/drivers/usb/core/devio.c
> @@ -1473,6 +1473,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
>  	case USBDEVFS_URB_TYPE_CONTROL:
>  		if (!usb_endpoint_xfer_control(&ep->desc))
>  			return -EINVAL;
> +		if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
> +			return -EINVAL;
>  		/* min 8 byte setup packet */
>  		if (uurb->buffer_length < 8)
>  			return -EINVAL;
> @@ -1511,6 +1513,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
>  		break;
>  
>  	case USBDEVFS_URB_TYPE_BULK:
> +		if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
> +			return -EINVAL;
>  		switch (usb_endpoint_type(&ep->desc)) {
>  		case USB_ENDPOINT_XFER_CONTROL:
>  		case USB_ENDPOINT_XFER_ISOC:

You need to check interrupt URBs also.  It would be best to have a
single test before the big "switch" statement:

	if ((uurb->flags & USBDEVFS_URB_ISO_ASAP) &&
			uurb->type != USBDEVFS_URB_TYPE_ISOCHRONOUS)
		return -EINVAL;

Alan Stern


From 1583595523931605268@xxx Thu Nov 09 13:32:58 +0000 2017
X-GM-THRID: 1583459420844146869
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread