USB interface drivers need to check number of endpoints before trying to
access/use them. Quite a few drivers only use the default setting
(altsetting 0), so let's allow them to declare number of endpoints in
altsetting 0 they require to operate and have USB core check it for us
instead of having every driver implement check manually.
For compatibility, if driver does not specify number of endpoints (i.e.
number of endpoints is left at 0) we bypass the check in USB core and
expect the driver perform necessary checks on its own.
Acked-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
---
Greg, if the patch is reasonable I wonder if I can take it through my
tree, as I have a few drivers that do not check number of endpoints
properly and will crash the kernel when specially crafted device is
plugged in, as reported by Vladis Dronov.
drivers/usb/core/driver.c | 9 +++++++++
include/linux/usb.h | 7 +++++++
2 files changed, 16 insertions(+)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 6b5063e..d9f680d 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -306,6 +306,15 @@ static int usb_probe_interface(struct device *dev)
dev_dbg(dev, "%s - got id\n", __func__);
+ if (driver->num_endpoints &&
+ intf->altsetting[0].desc.bNumEndpoints < driver->num_endpoints) {
+
+ dev_err(dev, "Not enough endpoints %d (want %d)\n",
+ intf->altsetting[0].desc.bNumEndpoints,
+ driver->num_endpoints);
+ return -EINVAL;
+ }
+
error = usb_autoresume_device(udev);
if (error)
return error;
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 447fe29..93f8dfc 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1051,6 +1051,11 @@ struct usbdrv_wrap {
* @id_table: USB drivers use ID table to support hotplugging.
* Export this with MODULE_DEVICE_TABLE(usb,...). This must be set
* or your driver's probe function will never get called.
+ * @num_endpoints: Number of endpoints that should be present in default
+ * setting (altsetting 0) the driver needs to operate properly.
+ * The probe will be aborted if actual number of endpoints is less
+ * than what the driver specified here. 0 means no check should be
+ * performed.
* @dynids: used internally to hold the list of dynamically added device
* ids for this driver.
* @drvwrap: Driver-model core structure wrapper.
@@ -1099,6 +1104,8 @@ struct usb_driver {
const struct usb_device_id *id_table;
+ unsigned int num_endpoints;
+
struct usb_dynids dynids;
struct usbdrv_wrap drvwrap;
unsigned int no_dynamic_id:1;
--
2.6.0.rc2.230.g3dd15c0
--
Dmitry
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
