linux-stable.git/drivers/usb/core/devio.c, branch linux-3.14.y

USB: usbfs: fix potential infoleak in devio

2016-08-20T09:53:21+00:00

commit 681fef8380eb818c0b845fca5d2ab1dcbab114ee upstream.

The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via “copy_to_user”.

Signed-off-by: Kangjie Lu 
Signed-off-by: Charles (Chas) Williams 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: allow URBs to be reaped after disconnection

2015-08-03T16:29:58+00:00

commit 3f2cee73b650921b2e214bf487b2061a1c266504 upstream.

The usbfs API has a peculiar hole: Users are not allowed to reap their
URBs after the device has been disconnected.  There doesn't seem to be
any good reason for this; it is an ad-hoc inconsistency.

The patch allows users to issue the USBDEVFS_REAPURB and
USBDEVFS_REAPURBNDELAY ioctls (together with their 32-bit counterparts
on 64-bit systems) even after the device is gone.  If no URBs are
pending for a disconnected device then the ioctls will return -ENODEV
rather than -EAGAIN, because obviously no new URBs will ever be able
to complete.

The patch also adds a new capability flag for
USBDEVFS_GET_CAPABILITIES to indicate that the reap-after-disconnect
feature is supported.

Signed-off-by: Alan Stern 
Tested-by: Chris Dickens 
Acked-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

USB: devio: fix a condition in async_completed()

2015-08-03T16:29:54+00:00

commit 83ed07c5db71bc02bd646d6eb60b48908235cdf9 upstream.

Static checkers complain that the current condition is never true.  It
seems pretty likely that it's a typo and "URB" was intended instead of
"USB".

Fixes: 3d97ff63f899 ('usbdevfs: Use scatter-gather lists for large bulk transfers')
Signed-off-by: Dan Carpenter 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: don't leak kernel data in siginfo

2015-03-18T12:31:28+00:00

commit f0c2b68198589249afd2b1f2c4e8de8c03e19c16 upstream.

When a signal is delivered, the information in the siginfo structure
is copied to userspace.  Good security practice dicatates that the
unused fields in this structure should be initialized to 0 so that
random kernel stack data isn't exposed to the user.  This patch adds
such an initialization to the two places where usbfs raises signals.

Signed-off-by: Alan Stern 
Reported-by: Dave Mielke 
Signed-off-by: Greg Kroah-Hartman

USB: devio: fix issue with log flooding

2014-09-05T23:34:12+00:00

commit d310d05f1225d1f6f2bf505255fdf593bfbb3051 upstream.

usbfs allows user space to pass down an URB which sets URB_SHORT_NOT_OK
for output URBs. That causes usbcore to log messages without limit
for a nonsensical disallowed combination. The fix is to silently drop
the attribute in usbfs.
The problem is reported to exist since 3.14
https://www.virtualbox.org/ticket/13085

Signed-off-by: Oliver Neukum 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: core: correct spelling mistakes in comments and warning

2014-01-08T00:17:40+00:00

Signed-off-by: Rahul Bedarkar 
Acked-by: Randy Dunlap 
Signed-off-by: Greg Kroah-Hartman

drivers: usb: core: devio.c: Spaces to tabs for proc_control_compat()

2013-10-16T20:38:37+00:00

Replaced spaces by tabs for proc_control_compat() function.

Signed-off-by: Matthias Beyer 
Signed-off-by: Greg Kroah-Hartman

drivers: usb: core: devio.c: Spaces to tabs for proc_reapurbnonblock()

2013-10-16T20:38:37+00:00

Replaced spaces by tabs for proc_reapurbnonblock() function.

Signed-off-by: Matthias Beyer 
Signed-off-by: Greg Kroah-Hartman

Merge 3.12-rc3 into usb-next

2013-09-30T01:45:55+00:00

We want the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman

usb/core/devio.c: Don't reject control message to endpoint with wrong direction bit

2013-09-26T00:30:39+00:00

Trying to read data from the Pegasus Technologies NoteTaker (0e20:0101)
[1] with the Windows App (EasyNote) works natively but fails when
Windows is running under KVM (and the USB device handed to KVM).

The reason is a USB control message
 usb 4-2.2: control urb: bRequestType=22 bRequest=09 wValue=0200 wIndex=0001 wLength=0008
This goes to endpoint address 0x01 (wIndex); however, endpoint address
0x01 does not exist. There is an endpoint 0x81 though (same number,
but other direction); the app may have meant that endpoint instead.

The kernel thus rejects the IO and thus we see the failure.

Apparently, Linux is more strict here than Windows ... we can't change
the Win app easily, so that's a problem.

It seems that the Win app/driver is buggy here and the driver does not
behave fully according to the USB HID class spec that it claims to
belong to.  The device seems to happily deal with that though (and
seems to not really care about this value much).

So the question is whether the Linux kernel should filter here.
Rejecting has the risk that somewhat non-compliant userspace apps/
drivers (most likely in a virtual machine) are prevented from working.
Not rejecting has the risk of confusing an overly sensitive device with
such a transfer. Given the fact that Windows does not filter it makes
this risk rather small though.

The patch makes the kernel more tolerant: If the endpoint address in
wIndex does not exist, but an endpoint with toggled direction bit does,
it will let the transfer through. (It does NOT change the message.)

With attached patch, the app in Windows in KVM works.
 usb 4-2.2: check_ctrlrecip: process 13073 (qemu-kvm) requesting ep 01 but needs 81

I suspect this will mostly affect apps in virtual environments; as on
Linux the apps would have been adapted to the stricter handling of the
kernel. I have done that for mine[2].

[1] http://www.pegatech.com/
[2] https://sourceforge.net/projects/notetakerpen/

Signed-off-by: Kurt Garloff 
Acked-by: Alan Stern 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman