On Thu, 9 Nov 2017, Oliver Neukum wrote:
> Am Donnerstag, den 09.11.2017, 13:19 +0100 schrieb Andrey Konovalov:
> >
> > This isn't the "BOGUS urb xfer" warning, this is "BOGUS urb flags". So
> > 2 means the URB_ISO_ASAP flag, which is passed in urb->transfer_flags
> > but not allowed. And as far as I understand, it gets set because uurb
> > (which is passed from user space) has USBDEVFS_URB_ISO_ASAP flag set
> > when passed to proc_do_submiturb().
>
> Hi,
>
> yes we should filter better.
> Could you test?
>
> Regards
> Oliver
> Subject: [PATCH] USB: usbfs: Filter flags passed in from user space
>
> USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints.
> Improve sanity checking.
>
> Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx>
> ---
> drivers/usb/core/devio.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
> index c3aaafc25a04..abe6457516a2 100644
> --- a/drivers/usb/core/devio.c
> +++ b/drivers/usb/core/devio.c
> @@ -1473,6 +1473,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
> case USBDEVFS_URB_TYPE_CONTROL:
> if (!usb_endpoint_xfer_control(&ep->desc))
> return -EINVAL;
> + if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
> + return -EINVAL;
> /* min 8 byte setup packet */
> if (uurb->buffer_length < 8)
> return -EINVAL;
> @@ -1511,6 +1513,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
> break;
>
> case USBDEVFS_URB_TYPE_BULK:
> + if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
> + return -EINVAL;
> switch (usb_endpoint_type(&ep->desc)) {
> case USB_ENDPOINT_XFER_CONTROL:
> case USB_ENDPOINT_XFER_ISOC:
You need to check interrupt URBs also. It would be best to have a
single test before the big "switch" statement:
if ((uurb->flags & USBDEVFS_URB_ISO_ASAP) &&
uurb->type != USBDEVFS_URB_TYPE_ISOCHRONOUS)
return -EINVAL;
Alan Stern
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
