From patchwork Mon Oct 25 11:45:28 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 12581559 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D23EAC433EF for ; Mon, 25 Oct 2021 11:46:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BD22E61002 for ; Mon, 25 Oct 2021 11:46:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233265AbhJYLsr (ORCPT ); Mon, 25 Oct 2021 07:48:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:39196 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233249AbhJYLsn (ORCPT ); Mon, 25 Oct 2021 07:48:43 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7DFA161050; Mon, 25 Oct 2021 11:46:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1635162381; bh=+mqhTnTRdKxzatm608pkboowK18/NX3Pb/cHz5A3cJ4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ir6eCJ1DUOEYHgiq+ORiqwF3mb+j3YuAI938zPYtAA9dcFBXjBYAzjAgueUmGuZ+x DMsIChP5M9kmsn4GXMxPbWC+YYSTchd5XZi+AUjmgFEebJuQbH7ODbxDuX/zkwcBL3 u1Isp7x9L4pir+B3spedmn7LeRNGvXRFhXWUrvqS4mqlttA/R+HYukzdSsaxOIYjYS hSvmEW5WhzKewAmoaHB+R2tJIpAmrPM86ny2qxYgIkfgpWNJ68gkLzfucBrlR5xJBk M+enBOgsTtXzbvJRSFE8I/svxHfYVe42EoskmpTspMRynvSHjY73dWbs7B5Z0V49By U0v7oJ/l9u9gQ== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1meyQW-0001DD-5B; Mon, 25 Oct 2021 13:46:04 +0200 From: Johan Hovold To: Ian Abbott , H Hartley Sweeten Cc: Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Luca Ellero Subject: [PATCH 1/5] comedi: ni_usb6501: fix NULL-deref in command paths Date: Mon, 25 Oct 2021 13:45:28 +0200 Message-Id: <20211025114532.4599-2-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211025114532.4599-1-johan@kernel.org> References: <20211025114532.4599-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The driver uses endpoint-sized USB transfer buffers but had no sanity checks on the sizes. This can lead to zero-size-pointer dereferences or overflowed transfer buffers in ni6501_port_command() and ni6501_counter_command() if a (malicious) device has smaller max-packet sizes than expected (or when doing descriptor fuzz testing). Add the missing sanity checks to probe(). Fixes: a03bb00e50ab ("staging: comedi: add NI USB-6501 support") Cc: stable@vger.kernel.org # 3.18 Cc: Luca Ellero Signed-off-by: Johan Hovold --- drivers/comedi/drivers/ni_usb6501.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/comedi/drivers/ni_usb6501.c b/drivers/comedi/drivers/ni_usb6501.c index 5b6d9d783b2f..eb2e5c23f25d 100644 --- a/drivers/comedi/drivers/ni_usb6501.c +++ b/drivers/comedi/drivers/ni_usb6501.c @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00}; +/* Largest supported packets */ +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); + enum commands { READ_PORT, WRITE_PORT, @@ -486,12 +490,16 @@ static int ni6501_find_endpoints(struct comedi_device *dev) ep_desc = &iface_desc->endpoint[i].desc; if (usb_endpoint_is_bulk_in(ep_desc)) { + if (usb_endpoint_maxp(ep_desc) < RX_MAX_SIZE) + continue; if (!devpriv->ep_rx) devpriv->ep_rx = ep_desc; continue; } if (usb_endpoint_is_bulk_out(ep_desc)) { + if (usb_endpoint_maxp(ep_desc) < TX_MAX_SIZE) + continue; if (!devpriv->ep_tx) devpriv->ep_tx = ep_desc; continue; From patchwork Mon Oct 25 11:45:29 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 12581563 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 765B9C433FE for ; Mon, 25 Oct 2021 11:46:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5F2ED61073 for ; Mon, 25 Oct 2021 11:46:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233274AbhJYLst (ORCPT ); Mon, 25 Oct 2021 07:48:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:39188 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233244AbhJYLsn (ORCPT ); Mon, 25 Oct 2021 07:48:43 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7BBB861040; Mon, 25 Oct 2021 11:46:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1635162381; bh=C6b6shzhRQx1x+0AH40ydkjoZdICJyhayKRWOP2YLnA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g/++InfaFv2Agba1fI6fsz7SMriqU/xMfqpXpelu/zgLmNiLQN7vHR8ipHAyikUv8 8VEhBiC33AwOlFF1jIirj6Jat/mYbZPIwIIJ0LG2TlnXUJ0uZA48GobAQ1nPeyr8Rj QINwcd3VDgh2Z2FOLcfBRxhwSufCyR9zHl43JqYmQS3LQ6rDE459LXdJ4HvukAABBG WmgJ71jdDASRiA6N+nAR+Hpl2YlbqMo5bqFUBfd4QMSY9S3TiO3ISznvm5uRWcnL5K 8Zsoh5QEFkwj2BtodIrJbWBRHJJD9CKTc+ENxBsWD66Ek/x7I2vYQFO9HYILryYjKi MlhVPQE76/pBg== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1meyQW-0001DF-7e; Mon, 25 Oct 2021 13:46:04 +0200 From: Johan Hovold To: Ian Abbott , H Hartley Sweeten Cc: Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 2/5] comedi: dt9812: fix DMA buffers on stack Date: Mon, 25 Oct 2021 13:45:29 +0200 Message-Id: <20211025114532.4599-3-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211025114532.4599-1-johan@kernel.org> References: <20211025114532.4599-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org USB transfer buffers are typically mapped for DMA and must not be allocated on the stack or transfers will fail. Allocate proper transfer buffers in the various command helpers and return an error on short transfers instead of acting on random stack data. Note that this also fixes a stack info leak on systems where DMA is not used as 32 bytes are always sent to the device regardless of how short the command is. Fixes: 63274cd7d38a ("Staging: comedi: add usb dt9812 driver") Cc: stable@vger.kernel.org # 2.6.29 Signed-off-by: Johan Hovold --- drivers/comedi/drivers/dt9812.c | 109 ++++++++++++++++++++++++-------- 1 file changed, 82 insertions(+), 27 deletions(-) diff --git a/drivers/comedi/drivers/dt9812.c b/drivers/comedi/drivers/dt9812.c index 634f57730c1e..f15c306f2d06 100644 --- a/drivers/comedi/drivers/dt9812.c +++ b/drivers/comedi/drivers/dt9812.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include "../comedi_usb.h" @@ -237,22 +238,41 @@ static int dt9812_read_info(struct comedi_device *dev, { struct usb_device *usb = comedi_to_usb_dev(dev); struct dt9812_private *devpriv = dev->private; - struct dt9812_usb_cmd cmd; + struct dt9812_usb_cmd *cmd; int count, ret; + u8 *tbuf; - cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA); - cmd.u.flash_data_info.address = + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; + + cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA); + cmd->u.flash_data_info.address = cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset); - cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size); + cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size); /* DT9812 only responds to 32 byte writes!! */ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), - &cmd, 32, &count, DT9812_USB_TIMEOUT); + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); + kfree(cmd); if (ret) return ret; - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), - buf, buf_size, &count, DT9812_USB_TIMEOUT); + tbuf = kmalloc(buf_size, GFP_KERNEL); + if (!tbuf) + return -ENOMEM; + + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), + tbuf, buf_size, &count, DT9812_USB_TIMEOUT); + if (!ret) { + if (count == buf_size) + memcpy(buf, tbuf, buf_size); + else + ret = -EREMOTEIO; + } + kfree(tbuf); + + return ret; } static int dt9812_read_multiple_registers(struct comedi_device *dev, @@ -261,22 +281,41 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev, { struct usb_device *usb = comedi_to_usb_dev(dev); struct dt9812_private *devpriv = dev->private; - struct dt9812_usb_cmd cmd; + struct dt9812_usb_cmd *cmd; int i, count, ret; + u8 *buf; - cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); - cmd.u.read_multi_info.count = reg_count; + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; + + cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); + cmd->u.read_multi_info.count = reg_count; for (i = 0; i < reg_count; i++) - cmd.u.read_multi_info.address[i] = address[i]; + cmd->u.read_multi_info.address[i] = address[i]; /* DT9812 only responds to 32 byte writes!! */ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), - &cmd, 32, &count, DT9812_USB_TIMEOUT); + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); + kfree(cmd); if (ret) return ret; - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), - value, reg_count, &count, DT9812_USB_TIMEOUT); + buf = kmalloc(reg_count, GFP_KERNEL); + if (!buf) + return -ENOMEM; + + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), + buf, reg_count, &count, DT9812_USB_TIMEOUT); + if (!ret) { + if (count == reg_count) + memcpy(value, buf, reg_count); + else + ret = -EREMOTEIO; + } + kfree(buf); + + return ret; } static int dt9812_write_multiple_registers(struct comedi_device *dev, @@ -285,19 +324,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev, { struct usb_device *usb = comedi_to_usb_dev(dev); struct dt9812_private *devpriv = dev->private; - struct dt9812_usb_cmd cmd; + struct dt9812_usb_cmd *cmd; int i, count; + int ret; + + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; - cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); - cmd.u.read_multi_info.count = reg_count; + cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); + cmd->u.read_multi_info.count = reg_count; for (i = 0; i < reg_count; i++) { - cmd.u.write_multi_info.write[i].address = address[i]; - cmd.u.write_multi_info.write[i].value = value[i]; + cmd->u.write_multi_info.write[i].address = address[i]; + cmd->u.write_multi_info.write[i].value = value[i]; } /* DT9812 only responds to 32 byte writes!! */ - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), - &cmd, 32, &count, DT9812_USB_TIMEOUT); + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); + kfree(cmd); + + return ret; } static int dt9812_rmw_multiple_registers(struct comedi_device *dev, @@ -306,17 +353,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev, { struct usb_device *usb = comedi_to_usb_dev(dev); struct dt9812_private *devpriv = dev->private; - struct dt9812_usb_cmd cmd; + struct dt9812_usb_cmd *cmd; int i, count; + int ret; + + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); + if (!cmd) + return -ENOMEM; - cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); - cmd.u.rmw_multi_info.count = reg_count; + cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); + cmd->u.rmw_multi_info.count = reg_count; for (i = 0; i < reg_count; i++) - cmd.u.rmw_multi_info.rmw[i] = rmw[i]; + cmd->u.rmw_multi_info.rmw[i] = rmw[i]; /* DT9812 only responds to 32 byte writes!! */ - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), - &cmd, 32, &count, DT9812_USB_TIMEOUT); + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); + kfree(cmd); + + return ret; } static int dt9812_digital_in(struct comedi_device *dev, u8 *bits) From patchwork Mon Oct 25 11:45:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 12581557 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83BCFC433FE for ; Mon, 25 Oct 2021 11:46:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6DD5B61002 for ; Mon, 25 Oct 2021 11:46:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233255AbhJYLsp (ORCPT ); Mon, 25 Oct 2021 07:48:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:39204 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233250AbhJYLsn (ORCPT ); Mon, 25 Oct 2021 07:48:43 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7FF2461073; Mon, 25 Oct 2021 11:46:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1635162381; bh=VpXDuc5ODD37c89+RKGeszqjBvCk2D5GP/X21UhgFC0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=phnnXdVJEPrhUoSVUAdSnVJSm+QykpAXYCVH9cjYbnX0ExfPHMb/gfJNxP9DBXDII CTUAW4lEJY32pZX6ENn3OfAFoxCmP7yHHmwOLGv+5ioF9X2NFpMLJG2n7plpNxTie8 25GSduHAEiNqcZ4UJ/aqZ1ZQzRobM04KgvIu4s1FKUj0MxtscgpTLdTP/PEND7KhRM tnqrfswOIHhQZJHLn5yxqSxyEH73pj5DU6a5nZltvWcnA+zjThDjdWm08hadWlKUSh 1CuQJQqlW9vcLaUXGfwwpdXc8H2JPvnrDg54SjxAlyjxDw7c+cCR4R/BDuJbO3b1h1 pFShIeJdcyCEg== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1meyQW-0001DI-Ac; Mon, 25 Oct 2021 13:46:04 +0200 From: Johan Hovold To: Ian Abbott , H Hartley Sweeten Cc: Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 3/5] comedi: vmk80xx: fix transfer-buffer overflows Date: Mon, 25 Oct 2021 13:45:30 +0200 Message-Id: <20211025114532.4599-4-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211025114532.4599-1-johan@kernel.org> References: <20211025114532.4599-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes. Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-pointer dereferences when accessing the transfer buffers in case a malicious device has a zero wMaxPacketSize. Make sure to allocate buffers large enough to handle also the other accesses that are done without a size check (e.g. byte 18 in vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond the buffers, for example, when doing descriptor fuzzing. The original driver was for a low-speed device with 8-byte buffers. Support was later added for a device that uses bulk transfers and is presumably a full-speed device with a maximum 64-byte wMaxPacketSize. Fixes: 985cafccbf9b ("Staging: Comedi: vmk80xx: Add k8061 support") Cc: stable@vger.kernel.org # 2.6.31 Signed-off-by: Johan Hovold Reviewed-by: Ian Abbott --- drivers/comedi/drivers/vmk80xx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/comedi/drivers/vmk80xx.c b/drivers/comedi/drivers/vmk80xx.c index 9f920819cd74..f2c1572d0cd7 100644 --- a/drivers/comedi/drivers/vmk80xx.c +++ b/drivers/comedi/drivers/vmk80xx.c @@ -90,6 +90,8 @@ enum { #define IC3_VERSION BIT(0) #define IC6_VERSION BIT(1) +#define MIN_BUF_SIZE 64 + enum vmk80xx_model { VMK8055_MODEL, VMK8061_MODEL @@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev) struct vmk80xx_private *devpriv = dev->private; size_t size; - size = usb_endpoint_maxp(devpriv->ep_rx); + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL); if (!devpriv->usb_rx_buf) return -ENOMEM; - size = usb_endpoint_maxp(devpriv->ep_tx); + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); if (!devpriv->usb_tx_buf) return -ENOMEM; From patchwork Mon Oct 25 11:45:31 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 12581561 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13CB4C4332F for ; Mon, 25 Oct 2021 11:46:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EEFC361040 for ; Mon, 25 Oct 2021 11:46:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233250AbhJYLss (ORCPT ); Mon, 25 Oct 2021 07:48:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:39214 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233251AbhJYLsn (ORCPT ); Mon, 25 Oct 2021 07:48:43 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 821C261076; Mon, 25 Oct 2021 11:46:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1635162381; bh=SE2uA80Y728ubzRuP43yoQCcRvgaEZWwlnRAZGAxKo0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kgJnPtUo3c9Qvf4tmiS4gKq+xMeJXkbsONjV7gXXsn++KtvVX3XibOGf6J2jMOhHu 1nqh3oDIXi4lNuololneAhbCRdaPboGDDxKc1d/zV9o59t8SHiYQbb7XjOGwg1oSLW bizcJtaztiViX4yrTZiv64EdTh9ntM37S5bytdzs59hJEAS3X47xxWQ3fe+9tkgAcO jkE+QWv9G2oEDee4yWcJ49B/Y76UebeBx5q/l/oov+OToPhVp6Niu9r+fM03qod3mB xYeX8nDMshMEpYtWDHS/iadHFAvef4zI/2TSNIMqHM95YUbDCldXdbOC+uXJ9FAWvn ji3bMNjiSRrtQ== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1meyQW-0001DK-Dp; Mon, 25 Oct 2021 13:46:04 +0200 From: Johan Hovold To: Ian Abbott , H Hartley Sweeten Cc: Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 4/5] comedi: vmk80xx: fix bulk-buffer overflow Date: Mon, 25 Oct 2021 13:45:31 +0200 Message-Id: <20211025114532.4599-5-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211025114532.4599-1-johan@kernel.org> References: <20211025114532.4599-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The driver is using endpoint-sized buffers but must not assume that the tx and rx buffers are of equal size or a malicious device could overflow the slab-allocated receive buffer when doing bulk transfers. Fixes: 985cafccbf9b ("Staging: Comedi: vmk80xx: Add k8061 support") Cc: stable@vger.kernel.org # 2.6.31 Signed-off-by: Johan Hovold Reviewed-by: Ian Abbott --- drivers/comedi/drivers/vmk80xx.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/comedi/drivers/vmk80xx.c b/drivers/comedi/drivers/vmk80xx.c index f2c1572d0cd7..9c56918e3b76 100644 --- a/drivers/comedi/drivers/vmk80xx.c +++ b/drivers/comedi/drivers/vmk80xx.c @@ -159,22 +159,20 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev) __u8 rx_addr; unsigned int tx_pipe; unsigned int rx_pipe; - size_t size; + size_t tx_size; + size_t rx_size; tx_addr = devpriv->ep_tx->bEndpointAddress; rx_addr = devpriv->ep_rx->bEndpointAddress; tx_pipe = usb_sndbulkpipe(usb, tx_addr); rx_pipe = usb_rcvbulkpipe(usb, rx_addr); - - /* - * The max packet size attributes of the K8061 - * input/output endpoints are identical - */ - size = usb_endpoint_maxp(devpriv->ep_tx); + tx_size = usb_endpoint_maxp(devpriv->ep_tx); + rx_size = usb_endpoint_maxp(devpriv->ep_rx); usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, - size, NULL, devpriv->ep_tx->bInterval); - usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10); + tx_size, NULL, devpriv->ep_tx->bInterval); + + usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL, HZ * 10); } static int vmk80xx_read_packet(struct comedi_device *dev) From patchwork Mon Oct 25 11:45:32 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 12581565 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F40AC433FE for ; Mon, 25 Oct 2021 11:46:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2D0A761002 for ; Mon, 25 Oct 2021 11:46:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233285AbhJYLst (ORCPT ); Mon, 25 Oct 2021 07:48:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:39168 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233243AbhJYLsn (ORCPT ); Mon, 25 Oct 2021 07:48:43 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 703AA61002; Mon, 25 Oct 2021 11:46:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1635162381; bh=EYRg6Kk1mOFdtTobWnLjNW8brE5BqDoSMG07X32ZNmc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OfzqmfEuaTAZi5ldwr++kvuDXSTMf8ZaIGfKw5/ZbRvIARpI7w8JodPhynhi3W8bh PT24iFl2RdjIVoWoLURbnVG/5wFlNqrFdFIbWG3zjm6kdLZpIjEQHlYNEkxTtwR4nf PfYN6rlR+ALjCHxIn4JmgQjGAiUtjaajgmP1eePG9dffPmOz84IyVnoguLXUHPy9vx alpI3GAijwWfj9m/Onlmq/u52toYRyavqiEqMQDlLjaXaW2BBLf9dChXJ1w2hPcbv/ /SQaWMnwpkxv7hAzceyUF1OGPlsq3hPooxbDS/3JPZbx1KswUlqLoVxwTli/ZUkZNl DPIC26KZMnI3A== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1meyQW-0001DP-Gi; Mon, 25 Oct 2021 13:46:04 +0200 From: Johan Hovold To: Ian Abbott , H Hartley Sweeten Cc: Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 5/5] comedi: vmk80xx: fix bulk and interrupt message timeouts Date: Mon, 25 Oct 2021 13:45:32 +0200 Message-Id: <20211025114532.4599-6-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211025114532.4599-1-johan@kernel.org> References: <20211025114532.4599-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org USB bulk and interrupt message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Note that the bulk-out transfer timeout was set to the endpoint bInterval value, which should be ignored for bulk endpoints and is typically set to zero. This meant that a failing bulk-out transfer would never time out. Assume that the 10 second timeout used for all other transfers is more than enough also for the bulk-out endpoint. Fixes: 985cafccbf9b ("Staging: Comedi: vmk80xx: Add k8061 support") Fixes: 951348b37738 ("staging: comedi: vmk80xx: wait for URBs to complete") Cc: stable@vger.kernel.org # 2.6.31 Signed-off-by: Johan Hovold Reviewed-by: Ian Abbott --- drivers/comedi/drivers/vmk80xx.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/comedi/drivers/vmk80xx.c b/drivers/comedi/drivers/vmk80xx.c index 9c56918e3b76..4b00a9ea611a 100644 --- a/drivers/comedi/drivers/vmk80xx.c +++ b/drivers/comedi/drivers/vmk80xx.c @@ -91,6 +91,7 @@ enum { #define IC6_VERSION BIT(1) #define MIN_BUF_SIZE 64 +#define PACKET_TIMEOUT 10000 /* ms */ enum vmk80xx_model { VMK8055_MODEL, @@ -169,10 +170,11 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev) tx_size = usb_endpoint_maxp(devpriv->ep_tx); rx_size = usb_endpoint_maxp(devpriv->ep_rx); - usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, - tx_size, NULL, devpriv->ep_tx->bInterval); + usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL, + PACKET_TIMEOUT); - usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL, HZ * 10); + usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL, + PACKET_TIMEOUT); } static int vmk80xx_read_packet(struct comedi_device *dev) @@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev) pipe = usb_rcvintpipe(usb, ep->bEndpointAddress); return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf, usb_endpoint_maxp(ep), NULL, - HZ * 10); + PACKET_TIMEOUT); } static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) @@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) pipe = usb_sndintpipe(usb, ep->bEndpointAddress); return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf, usb_endpoint_maxp(ep), NULL, - HZ * 10); + PACKET_TIMEOUT); } static int vmk80xx_reset_device(struct comedi_device *dev)