linux-stable.git/drivers/usb/core/sysfs.c, branch linux-4.9.y Linux kernel stable tree usb: core: fix slab-out-of-bounds Read in read_descriptors 2020-09-23T06:46:13+00:00 Zeng Tao prime.zeng@hisilicon.com 2020-09-04T06:37:44+00:00 d2a6d7054d134bbe5051548697ac1aa524df18be commit a18cd6c9b6bc73dc17e8b7e9bd07decaa8833c97 upstream. The USB device descriptor may get changed between two consecutive enumerations on the same device for some reason, such as DFU or malicius device. In that case, we may access the changing descriptor if we don't take the device lock here. The issue is reported: https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be9 Cc: stable <stable@vger.kernel.org> Cc: Alan Stern <stern@rowland.harvard.edu> Reported-by: syzbot+256e56ddde8b8957eabd@syzkaller.appspotmail.com Fixes: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute") Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com> Link: https://lore.kernel.org/r/1599201467-11000-1-git-send-email-prime.zeng@hisilicon.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit a18cd6c9b6bc73dc17e8b7e9bd07decaa8833c97 upstream.

The USB device descriptor may get changed between two consecutive
enumerations on the same device for some reason, such as DFU or
malicius device.
In that case, we may access the changing descriptor if we don't take
the device lock here.

The issue is reported:
https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be9

Cc: stable <stable@vger.kernel.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Reported-by: syzbot+256e56ddde8b8957eabd@syzkaller.appspotmail.com
Fixes: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Link: https://lore.kernel.org/r/1599201467-11000-1-git-send-email-prime.zeng@hisilicon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: Add new USB LPM helpers 2019-05-02T07:32:02+00:00 Kai-Heng Feng kai.heng.feng@canonical.com 2019-01-11T19:54:24+00:00 c73982bb65cb2a53af2824a2c20e26c4edfd4259 commit 7529b2574a7aaf902f1f8159fbc2a7caa74be559 upstream. Use new helpers to make LPM enabling/disabling more clear. This is a preparation to subsequent patch. Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Cc: stable <stable@vger.kernel.org> # after much soaking Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 7529b2574a7aaf902f1f8159fbc2a7caa74be559 upstream.

Use new helpers to make LPM enabling/disabling more clear.

This is a preparation to subsequent patch.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: stable <stable@vger.kernel.org> # after much soaking
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: no locking for reading descriptors in sysfs 2016-02-03T21:29:12+00:00 Oliver Neukum oneukum@suse.com 2016-01-21T14:18:48+00:00 b4a90d04ac79349799f65dfd7fa30b2aac6b2a4d Quting the relevant thread: > In fact, I suspect the locking added by the kernel 3.13 commit for > read_descriptors() is invalid because read_descriptors() performs no USB > activity; read_descriptors() just reads information from an allocated > memory structure. This structure is protected as the structure is > existing before and after the sysfs vfs descriptors entry is created or > destroyed. You're right. For some reason I thought that usb_deauthorize_device() would destroy the rawdescriptor structures (as mentioned in that commit's Changelog), but it doesn't. The locking in read_descriptors() is unnecessary. > The information is only written at the time of enumeration > and does not change. At least that is my understanding. > > It is noted that in our testing of kernel 3.8 on ARM, that sysfs > read_descriptors() was non-blocking because the kernel 3.13 comment was > not there. > > The pre-kernel 3.13 sysfs read_descriptors() seemed to work OK. > > Proposal: > ========= > > Remove the usb_lock_device(udev) and usb_unlock_device(udev) from > devices/usb/core/sysfs.c in read_descriptors() that was added by the > kernel 3.13 commit > "232275a USB: fix substandard locking for the sysfs files" > > Any comments to this proposal ? It seems okay to me. Please submit a patch. So this removes the locking making the point about -EINTR in the first path moot. Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Quting the relevant thread:

> In fact, I suspect the locking added by the kernel 3.13 commit for
> read_descriptors() is invalid because read_descriptors() performs no USB
> activity; read_descriptors() just reads information from an allocated
> memory structure. This structure is protected as the structure is
> existing before and after the sysfs vfs descriptors entry is created or
> destroyed.

You're right.  For some reason I thought that usb_deauthorize_device()
would destroy the rawdescriptor structures (as mentioned in that
commit's Changelog), but it doesn't.  The locking in read_descriptors()
is unnecessary.

> The information is only written at the time of enumeration
> and does not change. At least that is my understanding.
>
> It is noted that in our testing of kernel 3.8 on ARM, that sysfs
> read_descriptors() was non-blocking because the kernel 3.13 comment was
> not there.
>
> The pre-kernel 3.13 sysfs read_descriptors() seemed to work OK.
>
> Proposal:
> =========
>
> Remove the usb_lock_device(udev) and usb_unlock_device(udev) from
> devices/usb/core/sysfs.c in read_descriptors() that was added by the
> kernel 3.13 commit
> "232275a USB: fix substandard locking for the sysfs files"
>
> Any comments to this proposal ?

It seems okay to me.  Please submit a patch.

So this removes the locking making the point about -EINTR in
the first path moot.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: sysfs: make locking interruptible 2016-02-03T21:29:12+00:00 Oliver Neukum oneukum@suse.com 2016-01-21T14:18:47+00:00 7dd9cba5bb90ffa9c60c1533b715dc91c5082cd9 232275a USB: fix substandard locking for the sysfs files introduced needed locking into sysfs operations on USB devices It, however, uses uninterruptible sleep and if the error handling is on extreme cases of sleep lengths of 10s of seconds are possible. Unless we are removing the device we should use interruptible sleep. Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
232275a USB: fix substandard locking for the sysfs files
introduced needed locking into sysfs operations on USB devices
It, however, uses uninterruptible sleep and if the error
handling is on extreme cases of sleep lengths of 10s of seconds
are possible. Unless we are removing the device we should use
interruptible sleep.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: show speed "10000" in sysfs for USB 3.1 SuperSpeedPlus devices 2016-01-25T04:16:52+00:00 Mathias Nyman mathias.nyman@linux.intel.com 2015-12-10T07:59:27+00:00 b2316645ca5ea93eb8f637f57199fbbe88bee07d The same way as SuperSpeed devices show "5000" as device speed we wan't to show "10000" as the default speed for SuperSpeedPlus devices in sysfs. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The same way as SuperSpeed devices show "5000" as device speed we wan't to
show "10000" as the default speed for SuperSpeedPlus devices in sysfs.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: core: lpm: fix usb3_hardware_lpm sysfs node 2015-12-01T22:58:18+00:00 Lu Baolu baolu.lu@linux.intel.com 2015-11-14T08:26:32+00:00 bf5ce5bf3cc7136fd7fe5e8999a580bc93a9c8f6 Commit 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3 hardware LPM") introduced usb3_hardware_lpm sysfs node. This doesn't show the correct status of USB3 U1 and U2 LPM status. This patch fixes this by replacing usb3_hardware_lpm with two nodes, usb3_hardware_lpm_u1 (for U1) and usb3_hardware_lpm_u2 (for U2), and recording the U1/U2 LPM status in right places. This patch should be back-ported to kernels as old as 4.3, that contains Commit 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3 hardware LPM"). Cc: stable@vger.kernel.org Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Commit 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3
hardware LPM") introduced usb3_hardware_lpm sysfs node. This
doesn't show the correct status of USB3 U1 and U2 LPM status.

This patch fixes this by replacing usb3_hardware_lpm with two
nodes, usb3_hardware_lpm_u1 (for U1) and usb3_hardware_lpm_u2
(for U2), and recording the U1/U2 LPM status in right places.

This patch should be back-ported to kernels as old as 4.3,
that contains Commit 655fe4effe0f ("usbcore: add sysfs support
to xHCI usb3 hardware LPM").

Cc: stable@vger.kernel.org
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: interface authorization: SysFS part of USB interface authorization 2015-09-22T19:08:40+00:00 Stefan Koch stefan.koch10@gmail.com 2015-08-25T19:10:09+00:00 310d2b4124c073a2057ef9d952d4d938e9b1dfd9 This introduces an attribute for each interface to authorize (1) or deauthorize (0) it: /sys/bus/usb/devices/INTERFACE/authorized Signed-off-by: Stefan Koch <stefan.koch10@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This introduces an attribute for each interface to
authorize (1) or deauthorize (0) it:
/sys/bus/usb/devices/INTERFACE/authorized

Signed-off-by: Stefan Koch <stefan.koch10@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Revert "usb: interface authorization: SysFS part of USB interface authorization" 2015-08-18T16:57:43+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2015-08-18T16:57:43+00:00 4d924d7a81627663720223b5c4330c18d8063fb6 This reverts commit 187b3d75bbfba45a38b5d1d3656c0f11f6f6f2d0 as the signed-off-by address is invalid. Cc: Stefan Koch <stefan.koch10@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This reverts commit 187b3d75bbfba45a38b5d1d3656c0f11f6f6f2d0 as the
signed-off-by address is invalid.

Cc: Stefan Koch <stefan.koch10@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: interface authorization: SysFS part of USB interface authorization 2015-08-14T23:55:54+00:00 Stefan Koch stefan.koch10@gmail.com 2015-08-08T09:32:54+00:00 187b3d75bbfba45a38b5d1d3656c0f11f6f6f2d0 This introduces an attribute for each interface to authorize (1) or deauthorize (0) it: /sys/bus/usb/devices/INTERFACE/authorized Signed-off-by: Stefan Koch <skoch@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This introduces an attribute for each interface to
authorize (1) or deauthorize (0) it:
/sys/bus/usb/devices/INTERFACE/authorized

Signed-off-by: Stefan Koch <skoch@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usbcore: add sysfs support to xHCI usb3 hardware LPM 2015-07-22T22:45:03+00:00 Kevin Strasser kevin.strasser@linux.intel.com 2015-06-16T17:35:30+00:00 655fe4effe0f1f40e4f6ca6b3cc64a7fe0032183 Add a sysfs node to make it easier to verify if LPM is supported and being enabled for USB 3.0 devices. Signed-off-by: Kevin Strasser <kevin.strasser@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Add a sysfs node to make it easier to verify if LPM is supported and being
enabled for USB 3.0 devices.

Signed-off-by: Kevin Strasser <kevin.strasser@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>