Re: USB vulnerability

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> writes:
> On Thu, 28 Jul 2016, Alan Stern wrote:
>
>> Only bits 10..0 of the wMaxPacketSize field contain the maximum packet
>> size; bits 12..11 contain something else (valid only for high-speed
>> periodic endpoints) and bits 15..13 are reserved (see Table 9-13 in the
>> USB-2.0 spec).
>> 
>> Furthermore, the value in bits 10..0 is never supposed to be larger
>> than 1024 (or less depending on the speed and the endpoint type).  We
>> should check these things in config.c/usb_parse_endpoint().
>> 
>> I will whip up a patch for this shortly.
>
> And here it is.  Rosie, can you or your intern check that this fixes 
> the problem?

slightly unrelated, but...

acket %d, setting to %d\n",
> +		    cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
> +		maxp = j;
> +		endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
> +	}
> +
>  	/*
>  	 * Some buggy high speed devices have bulk endpoints using
>  	 * maxpacket sizes other than 512.  High speed HCDs may not
> @@ -297,9 +360,6 @@ static int usb_parse_endpoint(struct dev
>  	 */
>  	if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
>  			&& usb_endpoint_xfer_bulk(d)) {
> -		unsigned maxp;
> -
> -		maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;

usb_endpoint_maxp() should probably be updated to return only maximum
packet size. Then we would need to introduce usb_endpoint_mult() or
something along those lines to take care of the other valid bits.

-- 
balbi

Attachment: signature.asc
Description: PGP signature


[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux