On Fri, May 14, 2021 at 07:50:19AM +0000, Hayes Wang wrote: > Greg KH <greg@xxxxxxxxx> > > Sent: Friday, May 14, 2021 2:49 PM > [...] > > Because people can create "bad" devices and plug them into a system > > which causes the driver to load and then potentially crash the system or > > do other bad things. > > > > USB drivers now need to be able to handle "malicious" devices, it's been > > that way for many years now. > > My question is that even I check whole the USB descriptor, the malicious > devices could duplicate it easily to pass my checks. That is, I could add a > lot of checks, but it still doesn't prevent malicious devices. Is this meaningful? The real motivation here, which nobody has mentioned explicitly yet, is that the driver needs to be careful enough that it won't crash no matter what bizarre, malfunctioning, or malicious device is attached. Even if a device isn't malicious, if it is buggy, broken, or malfunctioning in some way then it can present input that a normal device would never generate. If the driver isn't prepared to handle this unusual input, it may crash. That is specifically what we want to avoid. So if a peculiar emulated device created by syzbot is capable of crashing the driver, then somewhere there is a bug which needs to be fixed. It's true that fixing all these bugs might not protect against a malicious device which deliberately behaves in an apparently reasonable manner. But it does reduce the attack surface. Alan Stern
