Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'usb-4.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some USB fixes for 4.15-rc4.
There is the usual handful gadget/dwc2/dwc3 fixes as always, for
reported issues. But the most important things in here is the core fix
from Alan Stern to resolve a nasty security bug (my first attempt is
reverted, Alan's was much cleaner), as well as a number of usbip fixes
from Shuah Khan to resolve those reported security issues.
All of these have been in linux-next with no reported issues"
* tag 'usb-4.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
USB: core: prevent malicious bNumInterfaces overflow
Revert "USB: core: only clean up what we allocated"
USB: core: only clean up what we allocated
Revert "usb: gadget: allow to enable legacy drivers without USB_ETH"
usb: gadget: webcam: fix V4L2 Kconfig dependency
usb: dwc2: Fix TxFIFOn sizes and total TxFIFO size issues
usb: dwc3: gadget: Fix PCM1 for ISOC EP with ep->mult less than 3
usb: dwc3: of-simple: set dev_pm_ops
usb: dwc3: of-simple: fix missing clk_disable_unprepare
usb: dwc3: gadget: Wait longer for controller to end command processing
usb: xhci: fix TDS for MTK xHCI1.1
xhci: Don't add a virt_dev to the devs array before it's fully allocated
usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
usbip: prevent vhci_hcd driver from leaking a socket pointer address
usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
usbip: fix stub_rx: get_pipe() to validate endpoint number
tools/usbip: fixes potential (minor) "buffer overflow" (detected on recent gcc with -Werror)
USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
usb: musb: da8xx: fix babble condition handling
+144
-99
+3
-1
drivers/usb/core/config.c
+3
-1
drivers/usb/core/config.c
···
555
555
unsigned iad_num = 0;
556
556
557
557
memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
558
+
nintf = nintf_orig = config->desc.bNumInterfaces;
559
+
config->desc.bNumInterfaces = 0; // Adjusted later
560
+
558
561
if (config->desc.bDescriptorType != USB_DT_CONFIG ||
559
562
config->desc.bLength < USB_DT_CONFIG_SIZE ||
560
563
config->desc.bLength > size) {
···
571
568
buffer += config->desc.bLength;
572
569
size -= config->desc.bLength;
573
570
574
-
nintf = nintf_orig = config->desc.bNumInterfaces;
575
571
if (nintf > USB_MAXINTERFACES) {
576
572
dev_warn(ddev, "config %d has too many interfaces: %d, "
577
573
"using maximum allowed: %d\n",
+4
drivers/usb/dwc2/core.h
+4
drivers/usb/dwc2/core.h
···
537
537
* 2 - Internal DMA
538
538
* @power_optimized Are power optimizations enabled?
539
539
* @num_dev_ep Number of device endpoints available
540
+
* @num_dev_in_eps Number of device IN endpoints available
540
541
* @num_dev_perio_in_ep Number of device periodic IN endpoints
541
542
* available
542
543
* @dev_token_q_depth Device Mode IN Token Sequence Learning Queue
···
566
565
* 2 - 8 or 16 bits
567
566
* @snpsid: Value from SNPSID register
568
567
* @dev_ep_dirs: Direction of device endpoints (GHWCFG1)
568
+
* @g_tx_fifo_size[] Power-on values of TxFIFO sizes
569
569
*/
570
570
struct dwc2_hw_params {
571
571
unsigned op_mode:3;
···
588
586
unsigned fs_phy_type:2;
589
587
unsigned i2c_enable:1;
590
588
unsigned num_dev_ep:4;
589
+
unsigned num_dev_in_eps : 4;
591
590
unsigned num_dev_perio_in_ep:4;
592
591
unsigned total_fifo_size:16;
593
592
unsigned power_optimized:1;
594
593
unsigned utmi_phy_data_width:2;
595
594
u32 snpsid;
596
595
u32 dev_ep_dirs;
596
+
u32 g_tx_fifo_size[MAX_EPS_CHANNELS];
597
597
};
598
598
599
599
/* Size of control and EP0 buffers */
+2
-40
drivers/usb/dwc2/gadget.c
+2
-40
drivers/usb/dwc2/gadget.c
···
195
195
{
196
196
if (hsotg->hw_params.en_multiple_tx_fifo)
197
197
/* In dedicated FIFO mode we need count of IN EPs */
198
-
return (dwc2_readl(hsotg->regs + GHWCFG4) &
199
-
GHWCFG4_NUM_IN_EPS_MASK) >> GHWCFG4_NUM_IN_EPS_SHIFT;
198
+
return hsotg->hw_params.num_dev_in_eps;
200
199
else
201
200
/* In shared FIFO mode we need count of Periodic IN EPs */
202
201
return hsotg->hw_params.num_dev_perio_in_ep;
203
-
}
204
-
205
-
/**
206
-
* dwc2_hsotg_ep_info_size - return Endpoint Info Control block size in DWORDs
207
-
*/
208
-
static int dwc2_hsotg_ep_info_size(struct dwc2_hsotg *hsotg)
209
-
{
210
-
int val = 0;
211
-
int i;
212
-
u32 ep_dirs;
213
-
214
-
/*
215
-
* Don't need additional space for ep info control registers in
216
-
* slave mode.
217
-
*/
218
-
if (!using_dma(hsotg)) {
219
-
dev_dbg(hsotg->dev, "Buffer DMA ep info size 0\n");
220
-
return 0;
221
-
}
222
-
223
-
/*
224
-
* Buffer DMA mode - 1 location per endpoit
225
-
* Descriptor DMA mode - 4 locations per endpoint
226
-
*/
227
-
ep_dirs = hsotg->hw_params.dev_ep_dirs;
228
-
229
-
for (i = 0; i <= hsotg->hw_params.num_dev_ep; i++) {
230
-
val += ep_dirs & 3 ? 1 : 2;
231
-
ep_dirs >>= 2;
232
-
}
233
-
234
-
if (using_desc_dma(hsotg))
235
-
val = val * 4;
236
-
237
-
return val;
238
202
}
239
203
240
204
/**
···
207
243
*/
208
244
int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg)
209
245
{
210
-
int ep_info_size;
211
246
int addr;
212
247
int tx_addr_max;
213
248
u32 np_tx_fifo_size;
···
215
252
hsotg->params.g_np_tx_fifo_size);
216
253
217
254
/* Get Endpoint Info Control block size in DWORDs. */
218
-
ep_info_size = dwc2_hsotg_ep_info_size(hsotg);
219
-
tx_addr_max = hsotg->hw_params.total_fifo_size - ep_info_size;
255
+
tx_addr_max = hsotg->hw_params.total_fifo_size;
220
256
221
257
addr = hsotg->params.g_rx_fifo_size + np_tx_fifo_size;
222
258
if (tx_addr_max <= addr)
+19
-10
drivers/usb/dwc2/params.c
+19
-10
drivers/usb/dwc2/params.c
···
484
484
}
485
485
486
486
for (fifo = 1; fifo <= fifo_count; fifo++) {
487
-
dptxfszn = (dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
488
-
FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
487
+
dptxfszn = hsotg->hw_params.g_tx_fifo_size[fifo];
489
488
490
489
if (hsotg->params.g_tx_fifo_size[fifo] < min ||
491
490
hsotg->params.g_tx_fifo_size[fifo] > dptxfszn) {
···
608
609
struct dwc2_hw_params *hw = &hsotg->hw_params;
609
610
bool forced;
610
611
u32 gnptxfsiz;
612
+
int fifo, fifo_count;
611
613
612
614
if (hsotg->dr_mode == USB_DR_MODE_HOST)
613
615
return;
···
616
616
forced = dwc2_force_mode_if_needed(hsotg, false);
617
617
618
618
gnptxfsiz = dwc2_readl(hsotg->regs + GNPTXFSIZ);
619
+
620
+
fifo_count = dwc2_hsotg_tx_fifo_count(hsotg);
621
+
622
+
for (fifo = 1; fifo <= fifo_count; fifo++) {
623
+
hw->g_tx_fifo_size[fifo] =
624
+
(dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
625
+
FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
626
+
}
619
627
620
628
if (forced)
621
629
dwc2_clear_force_mode(hsotg);
···
669
661
hwcfg4 = dwc2_readl(hsotg->regs + GHWCFG4);
670
662
grxfsiz = dwc2_readl(hsotg->regs + GRXFSIZ);
671
663
672
-
/*
673
-
* Host specific hardware parameters. Reading these parameters
674
-
* requires the controller to be in host mode. The mode will
675
-
* be forced, if necessary, to read these values.
676
-
*/
677
-
dwc2_get_host_hwparams(hsotg);
678
-
dwc2_get_dev_hwparams(hsotg);
679
-
680
664
/* hwcfg1 */
681
665
hw->dev_ep_dirs = hwcfg1;
682
666
···
711
711
hw->en_multiple_tx_fifo = !!(hwcfg4 & GHWCFG4_DED_FIFO_EN);
712
712
hw->num_dev_perio_in_ep = (hwcfg4 & GHWCFG4_NUM_DEV_PERIO_IN_EP_MASK) >>
713
713
GHWCFG4_NUM_DEV_PERIO_IN_EP_SHIFT;
714
+
hw->num_dev_in_eps = (hwcfg4 & GHWCFG4_NUM_IN_EPS_MASK) >>
715
+
GHWCFG4_NUM_IN_EPS_SHIFT;
714
716
hw->dma_desc_enable = !!(hwcfg4 & GHWCFG4_DESC_DMA);
715
717
hw->power_optimized = !!(hwcfg4 & GHWCFG4_POWER_OPTIMIZ);
716
718
hw->utmi_phy_data_width = (hwcfg4 & GHWCFG4_UTMI_PHY_DATA_WIDTH_MASK) >>
···
721
719
/* fifo sizes */
722
720
hw->rx_fifo_size = (grxfsiz & GRXFSIZ_DEPTH_MASK) >>
723
721
GRXFSIZ_DEPTH_SHIFT;
722
+
/*
723
+
* Host specific hardware parameters. Reading these parameters
724
+
* requires the controller to be in host mode. The mode will
725
+
* be forced, if necessary, to read these values.
726
+
*/
727
+
dwc2_get_host_hwparams(hsotg);
728
+
dwc2_get_dev_hwparams(hsotg);
724
729
725
730
return 0;
726
731
}
+4
-1
drivers/usb/dwc3/dwc3-of-simple.c
+4
-1
drivers/usb/dwc3/dwc3-of-simple.c
···
51
51
52
52
clk = of_clk_get(np, i);
53
53
if (IS_ERR(clk)) {
54
-
while (--i >= 0)
54
+
while (--i >= 0) {
55
+
clk_disable_unprepare(simple->clks[i]);
55
56
clk_put(simple->clks[i]);
57
+
}
56
58
return PTR_ERR(clk);
57
59
}
58
60
···
205
203
.driver = {
206
204
.name = "dwc3-of-simple",
207
205
.of_match_table = of_dwc3_simple_match,
206
+
.pm = &dwc3_of_simple_dev_pm_ops,
208
207
},
209
208
};
210
209
+2
-2
drivers/usb/dwc3/gadget.c
+2
-2
drivers/usb/dwc3/gadget.c
···
259
259
{
260
260
const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
261
261
struct dwc3 *dwc = dep->dwc;
262
-
u32 timeout = 500;
262
+
u32 timeout = 1000;
263
263
u32 reg;
264
264
265
265
int cmd_status = 0;
···
912
912
*/
913
913
if (speed == USB_SPEED_HIGH) {
914
914
struct usb_ep *ep = &dep->endpoint;
915
-
unsigned int mult = ep->mult - 1;
915
+
unsigned int mult = 2;
916
916
unsigned int maxp = usb_endpoint_maxp(ep->desc);
917
917
918
918
if (length <= (2 * maxp))
+2
-2
drivers/usb/gadget/Kconfig
+2
-2
drivers/usb/gadget/Kconfig
+1
-11
drivers/usb/gadget/legacy/Kconfig
+1
-11
drivers/usb/gadget/legacy/Kconfig
···
13
13
# both kinds of controller can also support "USB On-the-Go" (CONFIG_USB_OTG).
14
14
#
15
15
16
-
menuconfig USB_GADGET_LEGACY
17
-
bool "Legacy USB Gadget Support"
18
-
help
19
-
Legacy USB gadgets are USB gadgets that do not use the USB gadget
20
-
configfs interface.
21
-
22
-
if USB_GADGET_LEGACY
23
-
24
16
config USB_ZERO
25
17
tristate "Gadget Zero (DEVELOPMENT)"
26
18
select USB_LIBCOMPOSITE
···
479
487
# or video class gadget drivers), or specific hardware, here.
480
488
config USB_G_WEBCAM
481
489
tristate "USB Webcam Gadget"
482
-
depends on VIDEO_DEV
490
+
depends on VIDEO_V4L2
483
491
select USB_LIBCOMPOSITE
484
492
select VIDEOBUF2_VMALLOC
485
493
select USB_F_UVC
···
490
498
491
499
Say "y" to link the driver statically, or "m" to build a
492
500
dynamically linked module called "g_webcam".
493
-
494
-
endif
+11
-4
drivers/usb/host/xhci-mem.c
+11
-4
drivers/usb/host/xhci-mem.c
···
971
971
return 0;
972
972
}
973
973
974
-
xhci->devs[slot_id] = kzalloc(sizeof(*xhci->devs[slot_id]), flags);
975
-
if (!xhci->devs[slot_id])
974
+
dev = kzalloc(sizeof(*dev), flags);
975
+
if (!dev)
976
976
return 0;
977
-
dev = xhci->devs[slot_id];
978
977
979
978
/* Allocate the (output) device context that will be used in the HC. */
980
979
dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags);
···
1014
1015
1015
1016
trace_xhci_alloc_virt_device(dev);
1016
1017
1018
+
xhci->devs[slot_id] = dev;
1019
+
1017
1020
return 1;
1018
1021
fail:
1019
-
xhci_free_virt_device(xhci, slot_id);
1022
+
1023
+
if (dev->in_ctx)
1024
+
xhci_free_container_ctx(xhci, dev->in_ctx);
1025
+
if (dev->out_ctx)
1026
+
xhci_free_container_ctx(xhci, dev->out_ctx);
1027
+
kfree(dev);
1028
+
1020
1029
return 0;
1021
1030
}
1022
1031
+3
-3
drivers/usb/host/xhci-ring.c
+3
-3
drivers/usb/host/xhci-ring.c
···
3112
3112
{
3113
3113
u32 maxp, total_packet_count;
3114
3114
3115
-
/* MTK xHCI is mostly 0.97 but contains some features from 1.0 */
3115
+
/* MTK xHCI 0.96 contains some features from 1.0 */
3116
3116
if (xhci->hci_version < 0x100 && !(xhci->quirks & XHCI_MTK_HOST))
3117
3117
return ((td_total_len - transferred) >> 10);
3118
3118
···
3121
3121
trb_buff_len == td_total_len)
3122
3122
return 0;
3123
3123
3124
-
/* for MTK xHCI, TD size doesn't include this TRB */
3125
-
if (xhci->quirks & XHCI_MTK_HOST)
3124
+
/* for MTK xHCI 0.96, TD size include this TRB, but not in 1.x */
3125
+
if ((xhci->quirks & XHCI_MTK_HOST) && (xhci->hci_version < 0x100))
3126
3126
trb_buff_len = 0;
3127
3127
3128
3128
maxp = usb_endpoint_maxp(&urb->ep->desc);
+9
-1
drivers/usb/musb/da8xx.c
+9
-1
drivers/usb/musb/da8xx.c
···
284
284
musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;
285
285
portstate(musb->port1_status |= USB_PORT_STAT_POWER);
286
286
del_timer(&musb->dev_timer);
287
-
} else {
287
+
} else if (!(musb->int_usb & MUSB_INTR_BABBLE)) {
288
+
/*
289
+
* When babble condition happens, drvvbus interrupt
290
+
* is also generated. Ignore this drvvbus interrupt
291
+
* and let babble interrupt handler recovers the
292
+
* controller; otherwise, the host-mode flag is lost
293
+
* due to the MUSB_DEV_MODE() call below and babble
294
+
* recovery logic will not be called.
295
+
*/
288
296
musb->is_active = 0;
289
297
MUSB_DEV_MODE(musb);
290
298
otg->default_a = 0;
+7
drivers/usb/storage/unusual_devs.h
+7
drivers/usb/storage/unusual_devs.h
···
2100
2100
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
2101
2101
US_FL_BROKEN_FUA ),
2102
2102
2103
+
/* Reported by David Kozub <zub@linux.fjfi.cvut.cz> */
2104
+
UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
2105
+
"JMicron",
2106
+
"JMS567",
2107
+
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
2108
+
US_FL_BROKEN_FUA),
2109
+
2103
2110
/*
2104
2111
* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
2105
2112
* JMicron responds to USN and several other SCSI ioctls with a
+7
drivers/usb/storage/unusual_uas.h
+7
drivers/usb/storage/unusual_uas.h
···
129
129
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
130
130
US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
131
131
132
+
/* Reported-by: David Kozub <zub@linux.fjfi.cvut.cz> */
133
+
UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
134
+
"JMicron",
135
+
"JMS567",
136
+
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
137
+
US_FL_BROKEN_FUA),
138
+
132
139
/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
133
140
UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
134
141
"VIA",
+41
-10
drivers/usb/usbip/stub_rx.c
+41
-10
drivers/usb/usbip/stub_rx.c
···
322
322
return priv;
323
323
}
324
324
325
-
static int get_pipe(struct stub_device *sdev, int epnum, int dir)
325
+
static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
326
326
{
327
327
struct usb_device *udev = sdev->udev;
328
328
struct usb_host_endpoint *ep;
329
329
struct usb_endpoint_descriptor *epd = NULL;
330
+
int epnum = pdu->base.ep;
331
+
int dir = pdu->base.direction;
332
+
333
+
if (epnum < 0 || epnum > 15)
334
+
goto err_ret;
330
335
331
336
if (dir == USBIP_DIR_IN)
332
337
ep = udev->ep_in[epnum & 0x7f];
333
338
else
334
339
ep = udev->ep_out[epnum & 0x7f];
335
-
if (!ep) {
336
-
dev_err(&sdev->udev->dev, "no such endpoint?, %d\n",
337
-
epnum);
338
-
BUG();
339
-
}
340
+
if (!ep)
341
+
goto err_ret;
340
342
341
343
epd = &ep->desc;
344
+
345
+
/* validate transfer_buffer_length */
346
+
if (pdu->u.cmd_submit.transfer_buffer_length > INT_MAX) {
347
+
dev_err(&sdev->udev->dev,
348
+
"CMD_SUBMIT: -EMSGSIZE transfer_buffer_length %d\n",
349
+
pdu->u.cmd_submit.transfer_buffer_length);
350
+
return -1;
351
+
}
352
+
342
353
if (usb_endpoint_xfer_control(epd)) {
343
354
if (dir == USBIP_DIR_OUT)
344
355
return usb_sndctrlpipe(udev, epnum);
···
372
361
}
373
362
374
363
if (usb_endpoint_xfer_isoc(epd)) {
364
+
/* validate packet size and number of packets */
365
+
unsigned int maxp, packets, bytes;
366
+
367
+
maxp = usb_endpoint_maxp(epd);
368
+
maxp *= usb_endpoint_maxp_mult(epd);
369
+
bytes = pdu->u.cmd_submit.transfer_buffer_length;
370
+
packets = DIV_ROUND_UP(bytes, maxp);
371
+
372
+
if (pdu->u.cmd_submit.number_of_packets < 0 ||
373
+
pdu->u.cmd_submit.number_of_packets > packets) {
374
+
dev_err(&sdev->udev->dev,
375
+
"CMD_SUBMIT: isoc invalid num packets %d\n",
376
+
pdu->u.cmd_submit.number_of_packets);
377
+
return -1;
378
+
}
375
379
if (dir == USBIP_DIR_OUT)
376
380
return usb_sndisocpipe(udev, epnum);
377
381
else
378
382
return usb_rcvisocpipe(udev, epnum);
379
383
}
380
384
385
+
err_ret:
381
386
/* NOT REACHED */
382
-
dev_err(&sdev->udev->dev, "get pipe, epnum %d\n", epnum);
383
-
return 0;
387
+
dev_err(&sdev->udev->dev, "CMD_SUBMIT: invalid epnum %d\n", epnum);
388
+
return -1;
384
389
}
385
390
386
391
static void masking_bogus_flags(struct urb *urb)
···
460
433
struct stub_priv *priv;
461
434
struct usbip_device *ud = &sdev->ud;
462
435
struct usb_device *udev = sdev->udev;
463
-
int pipe = get_pipe(sdev, pdu->base.ep, pdu->base.direction);
436
+
int pipe = get_pipe(sdev, pdu);
437
+
438
+
if (pipe == -1)
439
+
return;
464
440
465
441
priv = stub_priv_alloc(sdev, pdu);
466
442
if (!priv)
···
482
452
}
483
453
484
454
/* allocate urb transfer buffer, if needed */
485
-
if (pdu->u.cmd_submit.transfer_buffer_length > 0) {
455
+
if (pdu->u.cmd_submit.transfer_buffer_length > 0 &&
456
+
pdu->u.cmd_submit.transfer_buffer_length <= INT_MAX) {
486
457
priv->urb->transfer_buffer =
487
458
kzalloc(pdu->u.cmd_submit.transfer_buffer_length,
488
459
GFP_KERNEL);
+7
drivers/usb/usbip/stub_tx.c
+7
drivers/usb/usbip/stub_tx.c
···
167
167
memset(&pdu_header, 0, sizeof(pdu_header));
168
168
memset(&msg, 0, sizeof(msg));
169
169
170
+
if (urb->actual_length > 0 && !urb->transfer_buffer) {
171
+
dev_err(&sdev->udev->dev,
172
+
"urb: actual_length %d transfer_buffer null\n",
173
+
urb->actual_length);
174
+
return -1;
175
+
}
176
+
170
177
if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
171
178
iovnum = 2 + urb->number_of_packets;
172
179
else
+1
drivers/usb/usbip/usbip_common.h
+1
drivers/usb/usbip/usbip_common.h
+16
-9
drivers/usb/usbip/vhci_sysfs.c
+16
-9
drivers/usb/usbip/vhci_sysfs.c
···
17
17
18
18
/*
19
19
* output example:
20
-
* hub port sta spd dev socket local_busid
21
-
* hs 0000 004 000 00000000 c5a7bb80 1-2.3
20
+
* hub port sta spd dev sockfd local_busid
21
+
* hs 0000 004 000 00000000 3 1-2.3
22
22
* ................................................
23
-
* ss 0008 004 000 00000000 d8cee980 2-3.4
23
+
* ss 0008 004 000 00000000 4 2-3.4
24
24
* ................................................
25
25
*
26
-
* IP address can be retrieved from a socket pointer address by looking
27
-
* up /proc/net/{tcp,tcp6}. Also, a userland program may remember a
28
-
* port number and its peer IP address.
26
+
* Output includes socket fd instead of socket pointer address to avoid
27
+
* leaking kernel memory address in:
28
+
* /sys/devices/platform/vhci_hcd.0/status and in debug output.
29
+
* The socket pointer address is not used at the moment and it was made
30
+
* visible as a convenient way to find IP address from socket pointer
31
+
* address by looking up /proc/net/{tcp,tcp6}. As this opens a security
32
+
* hole, the change is made to use sockfd instead.
33
+
*
29
34
*/
30
35
static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vdev)
31
36
{
···
44
39
if (vdev->ud.status == VDEV_ST_USED) {
45
40
*out += sprintf(*out, "%03u %08x ",
46
41
vdev->speed, vdev->devid);
47
-
*out += sprintf(*out, "%16p %s",
48
-
vdev->ud.tcp_socket,
42
+
*out += sprintf(*out, "%u %s",
43
+
vdev->ud.sockfd,
49
44
dev_name(&vdev->udev->dev));
50
45
51
46
} else {
···
165
160
char *s = out;
166
161
167
162
/*
168
-
* Half the ports are for SPEED_HIGH and half for SPEED_SUPER, thus the * 2.
163
+
* Half the ports are for SPEED_HIGH and half for SPEED_SUPER,
164
+
* thus the * 2.
169
165
*/
170
166
out += sprintf(out, "%d\n", VHCI_PORTS * vhci_num_controllers);
171
167
return out - s;
···
372
366
373
367
vdev->devid = devid;
374
368
vdev->speed = speed;
369
+
vdev->ud.sockfd = sockfd;
375
370
vdev->ud.tcp_socket = socket;
376
371
vdev->ud.status = VDEV_ST_NOTASSIGNED;
377
372
+5
-5
tools/usb/usbip/libsrc/vhci_driver.c
+5
-5
tools/usb/usbip/libsrc/vhci_driver.c
···
50
50
51
51
while (*c != '\0') {
52
52
int port, status, speed, devid;
53
-
unsigned long socket;
53
+
int sockfd;
54
54
char lbusid[SYSFS_BUS_ID_SIZE];
55
55
struct usbip_imported_device *idev;
56
56
char hub[3];
57
57
58
-
ret = sscanf(c, "%2s %d %d %d %x %lx %31s\n",
58
+
ret = sscanf(c, "%2s %d %d %d %x %u %31s\n",
59
59
hub, &port, &status, &speed,
60
-
&devid, &socket, lbusid);
60
+
&devid, &sockfd, lbusid);
61
61
62
62
if (ret < 5) {
63
63
dbg("sscanf failed: %d", ret);
···
66
66
67
67
dbg("hub %s port %d status %d speed %d devid %x",
68
68
hub, port, status, speed, devid);
69
-
dbg("socket %lx lbusid %s", socket, lbusid);
69
+
dbg("sockfd %u lbusid %s", sockfd, lbusid);
70
70
71
71
/* if a device is connected, look at it */
72
72
idev = &vhci_driver->idev[port];
···
106
106
return 0;
107
107
}
108
108
109
-
#define MAX_STATUS_NAME 16
109
+
#define MAX_STATUS_NAME 18
110
110
111
111
static int refresh_imported_device_list(void)
112
112
{