linux.git/drivers/usb/core/config.c, branch v6.11

USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor

2024-07-03T14:03:25+00:00

Syzbot has identified a bug in usbcore (see the Closes: tag below)
caused by our assumption that the reserved bits in an endpoint
descriptor's bEndpointAddress field will always be 0.  As a result of
the bug, the endpoint_is_duplicate() routine in config.c (and possibly
other routines as well) may believe that two descriptors are for
distinct endpoints, even though they have the same direction and
endpoint number.  This can lead to confusion, including the bug
identified by syzbot (two descriptors with matching endpoint numbers
and directions, where one was interrupt and the other was bulk).

To fix the bug, we will clear the reserved bits in bEndpointAddress
when we parse the descriptor.  (Note that both the USB-2.0 and USB-3.1
specs say these bits are "Reserved, reset to zero".)  This requires us
to make a copy of the descriptor earlier in usb_parse_endpoint() and
use the copy instead of the original when checking for duplicates.

Signed-off-by: Alan Stern 
Reported-and-tested-by: syzbot+8693a0bb9c10b554272a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/0000000000003d868e061bc0f554@google.com/
Fixes: 0a8fd1346254 ("USB: fix problems with duplicate endpoint addresses")
CC: Oliver Neukum 
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/205a5edc-7fef-4159-b64a-80374b6b101a@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman

USB: usb_parse_endpoint: ignore reserved bits

2024-05-03T05:35:37+00:00

Reading bEndpointAddress the spec tells is that:
  b7   is direction, which must be ignored
  b6:4 are reserved which are to be set to zero
  b3:0 are the endpoint address

In order to be backwards compatible with possible future versions of USB
we have to be ready with devices using those bits. That means that we
also have to ignore them like we do with the direction bit.

In consequence the only illegal address you can encoding in four bits is
endpoint zero, for which no descriptor must exist. Hence the check for
exceeding the upper limit on endpoint addresses is removed.

Signed-off-by: Oliver Neukum 
Reviewed-by: Alan Stern 
Link: https://lore.kernel.org/r/20240502115259.31076-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman

usb: config: fix iteration issue in 'usb_get_bos_descriptor()'

2023-11-21T14:30:56+00:00

The BOS descriptor defines a root descriptor and is the base descriptor for
accessing a family of related descriptors.

Function 'usb_get_bos_descriptor()' encounters an iteration issue when
skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in
the same descriptor being read repeatedly.

To address this issue, a 'goto' statement is introduced to ensure that the
pointer and the amount read is updated correctly. This ensures that the
function iterates to the next descriptor instead of reading the same
descriptor repeatedly.

Cc: stable@vger.kernel.org
Fixes: 3dd550a2d365 ("USB: usbcore: Fix slab-out-of-bounds bug during device reset")
Signed-off-by: Niklas Neronin 
Acked-by: Mathias Nyman 
Reviewed-by: Alan Stern 
Link: https://lore.kernel.org/r/20231115121325.471454-1-niklas.neronin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

USB: Remove remnants of Wireless USB and UWB

2023-08-09T12:17:06+00:00

Wireless USB has long been defunct, and kernel support for it was
removed in 2020 by commit caa6772db4c1 ("Staging: remove wusbcore and
UWB from the kernel tree.").

Nevertheless, some vestiges of the old implementation still clutter up
the USB subsystem and one or two other places.  Let's get rid of them
once and for all.

The only parts still left are the user-facing APIs in
include/uapi/linux/usb/ch9.h.  (There are also a couple of misleading
instances, such as the Sierra Wireless USB modem, which is a USB modem
made by Sierra Wireless.)

Signed-off-by: Alan Stern 
Link: https://lore.kernel.org/r/b4f2710f-a2de-4fb0-b50f-76776f3a961b@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman

USB: core: Change configuration warnings to notices

2022-11-03T14:46:00+00:00

It has been pointed out that the kernel log messages warning about
problems in USB configuration and related descriptors are vexing for
users.  The warning log level has a fairly high priority, but the user
can do nothing to fix the underlying errors in the device's firmware.

To reduce the amount of useless information produced by tools that
filter high-priority log messages, we can change these warnings to
notices, i.e., change dev_warn() to dev_notice().  The same holds for
a few messages that currently use dev_err(): Unless they indicate a
failure that might make a device unusable (such as inability to
transfer a config descriptor), change them to dev_notice() also.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216630
Suggested-by: Artem S. Tashkinov 
Signed-off-by: Alan Stern 
Link: https://lore.kernel.org/r/Y2KzPx0h6z1jXCuN@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman

usb: core: config: using bit mask instead of individual bits

2021-12-12T12:06:39+00:00

Using standard USB_EP_MAXP_MULT_MASK instead of individual bits for
extracting multiple-transactions bits from wMaxPacketSize value.

Acked-by: Alan Stern 
Signed-off-by: Pavel Hofman 
Link: https://lore.kernel.org/r/20211210085219.16796-2-pavel.hofman@ivitera.com
Signed-off-by: Greg Kroah-Hartman

usb: core: config: fix validation of wMaxPacketValue entries

2021-12-12T12:06:35+00:00

The checks performed by commit aed9d65ac327 ("USB: validate
wMaxPacketValue entries in endpoint descriptors") require that initial
value of the maxp variable contains both maximum packet size bits
(10..0) and multiple-transactions bits (12..11). However, the existing
code assings only the maximum packet size bits. This patch assigns all
bits of wMaxPacketSize to the variable.

Fixes: aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors")
Cc: stable 
Acked-by: Alan Stern 
Signed-off-by: Pavel Hofman 
Link: https://lore.kernel.org/r/20211210085219.16796-1-pavel.hofman@ivitera.com
Signed-off-by: Greg Kroah-Hartman

usb: core: config: Change sizeof(struct ...) to sizeof(*...)

2021-10-06T06:25:47+00:00

This fixes the following checkpatch.pl warnings:

drivers/usb/core/config.c:989: CHECK:ALLOC_SIZEOF_STRUCT: Prefer kzalloc(sizeof(*bos)...) over kzalloc(sizeof(struct usb_bos_descriptor)...)
drivers/usb/core/config.c:1010: CHECK:ALLOC_SIZEOF_STRUCT: Prefer kzalloc(sizeof(*dev->bos)...) over kzalloc(sizeof(struct usb_host_bos)...)

Signed-off-by: Robert Greener 
Link: https://lore.kernel.org/r/20211001151350.ijiexr3ebwvypmdd@shortbread
Signed-off-by: Greg Kroah-Hartman

usb: fix a few cases of -Wfallthrough

2020-11-13T14:20:52+00:00

The "fallthrough" pseudo-keyword was added as a portable way to denote
intentional fallthrough. Clang will still warn on cases where there is a
fallthrough to an immediate break. Add explicit breaks for those cases.

Reviewed-by: Nathan Chancellor 
Signed-off-by: Nick Desaulniers 
Link: https://lore.kernel.org/r/20201111014716.260633-1-ndesaulniers@google.com
Signed-off-by: Greg Kroah-Hartman

usb: Use fallthrough pseudo-keyword

2020-07-10T06:55:17+00:00

Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva 
Link: https://lore.kernel.org/r/20200707195607.GA4198@embeddedor
Signed-off-by: Greg Kroah-Hartman