diff mbox series

USB: core: Fix incorrect pipe calculation in do_proc_control()

Message ID 20210712185436.GB326369@rowland.harvard.edu (mailing list archive)
State Accepted
Commit b0863f1927323110e3d0d69f6adb6a91018a9a3c
Headers show
Series USB: core: Fix incorrect pipe calculation in do_proc_control() | expand

Commit Message

Alan Stern July 12, 2021, 6:54 p.m. UTC 
When the user submits a control URB via usbfs, the user supplies the
bRequestType value and the kernel uses it to compute the pipe value.
However, do_proc_control() performs this computation incorrectly in
the case where the bRequestType direction bit is set to USB_DIR_IN and
the URB's transfer length is 0: The pipe's direction is also set to IN
but it should be OUT, which is the direction the actual transfer will
use regardless of bRequestType.

Commit 5cc59c418fde ("USB: core: WARN if pipe direction != setup
packet direction") added a check to compare the direction bit in the
pipe value to a control URB's actual direction and to WARN if they are
different.  This can be triggered by the incorrect computation
mentioned above, as found by syzbot.

This patch fixes the computation, thus avoiding the WARNing.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+72af3105289dcb4c055b@syzkaller.appspotmail.com

---

Greg, I'm not sure which -stable kernels, if any, need this.  It should 
go into any kernel which contains 5cc59c418fde.


[as1963]


 drivers/usb/core/devio.c |   18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

Comments

Greg KH July 12, 2021, 6:59 p.m. UTC | #1 
On Mon, Jul 12, 2021 at 02:54:36PM -0400, Alan Stern wrote:
> When the user submits a control URB via usbfs, the user supplies the
> bRequestType value and the kernel uses it to compute the pipe value.
> However, do_proc_control() performs this computation incorrectly in
> the case where the bRequestType direction bit is set to USB_DIR_IN and
> the URB's transfer length is 0: The pipe's direction is also set to IN
> but it should be OUT, which is the direction the actual transfer will
> use regardless of bRequestType.
> 
> Commit 5cc59c418fde ("USB: core: WARN if pipe direction != setup
> packet direction") added a check to compare the direction bit in the
> pipe value to a control URB's actual direction and to WARN if they are
> different.  This can be triggered by the incorrect computation
> mentioned above, as found by syzbot.
> 
> This patch fixes the computation, thus avoiding the WARNing.
> 
> Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
> Reported-and-tested-by: syzbot+72af3105289dcb4c055b@syzkaller.appspotmail.com
> 
> ---
> 
> Greg, I'm not sure which -stable kernels, if any, need this.  It should 
> go into any kernel which contains 5cc59c418fde.

That's just 5.14-rc1, I asked for AUTOSEL to not take it so we should be
fine.

Thanks for the fix, I'll queue it up now.

greg k-h
diff mbox series

Patch

Index: usb-devel/drivers/usb/core/devio.c
===================================================================
--- usb-devel.orig/drivers/usb/core/devio.c
+++ usb-devel/drivers/usb/core/devio.c
@@ -1133,7 +1133,7 @@  static int do_proc_control(struct usb_de
 		"wIndex=%04x wLength=%04x\n",
 		ctrl->bRequestType, ctrl->bRequest, ctrl->wValue,
 		ctrl->wIndex, ctrl->wLength);
-	if (ctrl->bRequestType & 0x80) {
+	if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength) {
 		pipe = usb_rcvctrlpipe(dev, 0);
 		snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT, NULL, 0);