Skip to content
  1. Aug 09, 2023
  2. Aug 08, 2023
    • Alan Stern's avatar
      USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() · ff33299e
      Alan Stern authored
      Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors():
      
      BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
      Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011
      
      CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
      Call Trace:
       <TASK>
       __dump_stack lib/dump_stack.c:88 [inline]
       dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
       print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351
       print_report mm/kasan/report.c:462 [inline]
       kasan_report+0x11c/0x130 mm/kasan/report.c:572
       read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
      ...
      Allocated by task 758:
      ...
       __do_kmalloc_node mm/slab_common.c:966 [inline]
       __kmalloc+0x5e/0x190 mm/slab_common.c:979
       kmalloc include/linux/slab.h:563 [inline]
       kzalloc include/linux/slab.h:680 [inline]
       usb_get_configuration+0x1f7/0x5170 drivers/usb/core/config.c:887
       usb_enumerate_device drivers/usb/core/hub.c:2407 [inline]
       usb_new_device+0x12b0/0x19d0 drivers/usb/core/hub.c:2545
      
      As analyzed by Khazhy Kumykov, the cause of this bug is a race between
      read_descriptors() and hub_port_init(): The first routine uses a field
      in udev->descriptor, not expecting it to change, while the second
      overwrites it.
      
      Prior to commit 45bf39f8
      
       ("USB: core: Don't hold device lock while
      reading the "descriptors" sysfs file") this race couldn't occur,
      because the routines were mutually exclusive thanks to the device
      locking.  Removing that locking from read_descriptors() exposed it to
      the race.
      
      The best way to fix the bug is to keep hub_port_init() from changing
      udev->descriptor once udev has been initialized and registered.
      Drivers expect the descriptors stored in the kernel to be immutable;
      we should not undermine this expectation.  In fact, this change should
      have been made long ago.
      
      So now hub_port_init() will take an additional argument, specifying a
      buffer in which to store the device descriptor it reads.  (If udev has
      not yet been initialized, the buffer pointer will be NULL and then
      hub_port_init() will store the device descriptor in udev as before.)
      This eliminates the data race responsible for the out-of-bounds read.
      
      The changes to hub_port_init() appear more extensive than they really
      are, because of indentation changes resulting from an attempt to avoid
      writing to other parts of the usb_device structure after it has been
      initialized.  Similar changes should be made to the code that reads
      the BOS descriptor, but that can be handled in a separate patch later
      on.  This patch is sufficient to fix the bug found by syzbot.
      
      Reported-and-tested-by: default avatar <syzbot+18996170f8096c6174d0@syzkaller.appspotmail.com>
      Closes: https://lore.kernel.org/linux-usb/000000000000c0ffe505fe86c9ca@google.com/#r
      
      
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Cc: Khazhy Kumykov <khazhy@google.com>
      Fixes: 45bf39f8 ("USB: core: Don't hold device lock while reading the "descriptors" sysfs file")
      Cc: stable@vger.kernel.org
      Link: https://lore.kernel.org/r/b958b47a-9a46-4c22-a9f9-e42e42c31251@rowland.harvard.edu
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      ff33299e
    • Alan Stern's avatar
      USB: core: Change usb_get_device_descriptor() API · de28e469
      Alan Stern authored
      
      
      The usb_get_device_descriptor() routine reads the device descriptor
      from the udev device and stores it directly in udev->descriptor.  This
      interface is error prone, because the USB subsystem expects in-memory
      copies of a device's descriptors to be immutable once the device has
      been initialized.
      
      The interface is changed so that the device descriptor is left in a
      kmalloc-ed buffer, not copied into the usb_device structure.  A
      pointer to the buffer is returned to the caller, who is then
      responsible for kfree-ing it.  The corresponding changes needed in the
      various callers are fairly small.
      
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Link: https://lore.kernel.org/r/d0111bb6-56c1-4f90-adf2-6cfe152f6561@rowland.harvard.edu
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      de28e469
    • Alan Stern's avatar
      USB: core: Unite old scheme and new scheme descriptor reads · 85d07c55
      Alan Stern authored
      
      
      In preparation for reworking the usb_get_device_descriptor() routine,
      it is desirable to unite the two different code paths responsible for
      initially determining endpoint 0's maximum packet size in a newly
      discovered USB device.  Making this determination presents a
      chicken-and-egg sort of problem, in that the only way to learn the
      maxpacket value is to get it from the device descriptor retrieved from
      the device, but communicating with the device to retrieve a descriptor
      requires us to know beforehand the ep0 maxpacket size.
      
      In practice this problem is solved in two different ways, referred to
      in hub.c as the "old scheme" and the "new scheme".  The old scheme
      (which is the approach recommended by the USB-2 spec) involves asking
      the device to send just the first eight bytes of its device
      descriptor.  Such a transfer uses packets containing no more than
      eight bytes each, and every USB device must have an ep0 maxpacket size
      >= 8, so this should succeed.  Since the bMaxPacketSize0 field of the
      device descriptor lies within the first eight bytes, this is all we
      need.
      
      The new scheme is an imitation of the technique used in an early
      Windows USB implementation, giving it the happy advantage of working
      with a wide variety of devices (some of them at the time would not
      work with the old scheme, although that's probably less true now).  It
      involves making an initial guess of the ep0 maxpacket size, asking the
      device to send up to 64 bytes worth of its device descriptor (which is
      only 18 bytes long), and then resetting the device to clear any error
      condition that might have resulted from the guess being wrong.  The
      initial guess is determined by the connection speed; it should be
      correct in all cases other than full speed, for which the allowed
      values are 8, 16, 32, and 64 (in this case the initial guess is 64).
      
      The reason for this patch is that the old- and new-scheme parts of
      hub_port_init() use different code paths, one involving
      usb_get_device_descriptor() and one not, for their initial reads of
      the device descriptor.  Since these reads have essentially the same
      purpose and are made under essentially the same circumstances, this is
      illogical.  It makes more sense to have both of them use a common
      subroutine.
      
      This subroutine does basically what the new scheme's code did, because
      that approach is more general than the one used by the old scheme.  It
      only needs to know how many bytes to transfer and whether or not it is
      being called for the first iteration of a retry loop (in case of
      certain time-out errors).  There are two main differences from the
      former code:
      
      	We initialize the bDescriptorType field of the transfer buffer
      	to 0 before performing the transfer, to avoid possibly
      	accessing an uninitialized value afterward.
      
      	We read the device descriptor into a temporary buffer rather
      	than storing it directly into udev->descriptor, which the old
      	scheme implementation used to do.
      
      Since the whole point of this first read of the device descriptor is
      to determine the bMaxPacketSize0 value, that is what the new routine
      returns (or an error code).  The value is stored in a local variable
      rather than in udev->descriptor.  As a side effect, this necessitates
      moving a section of code that checks the bcdUSB field for SuperSpeed
      devices until after the full device descriptor has been retrieved.
      
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Cc: Oliver Neukum <oneukum@suse.com>
      Link: https://lore.kernel.org/r/495cb5d4-f956-4f4a-a875-1e67e9489510@rowland.harvard.edu
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      85d07c55
    • Ruan Jinjie's avatar
      USB: usbip: Remove an unnecessary goto · af6248af
      Ruan Jinjie authored
      
      
      When udc_dev = NULL, it is not necessary to goto out to return, just
      return NULL directly. And the out goto label can be removed.
      
      Signed-off-by: default avatarRuan Jinjie <ruanjinjie@huawei.com>
      Reviewed-by: default avatarShuah Khan <skhan@linuxfoundation.org>
      Link: https://lore.kernel.org/r/20230805045631.1858638-1-ruanjinjie@huawei.com
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      af6248af
    • Yue Haibing's avatar
      USB: misc: Remove unused include file usb_u132.h · a647b414
      Yue Haibing authored
      Since commit 8be17483
      
       ("usb: ftdi-elan: Delete driver") this include file
      is not used anymore, so can remove it.
      
      Signed-off-by: default avatarYue Haibing <yuehaibing@huawei.com>
      Link: https://lore.kernel.org/r/20230807141128.39092-1-yuehaibing@huawei.com
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a647b414
    • Yue Haibing's avatar
      usb: musb: Remove unused function declarations · d4255ac3
      Yue Haibing authored
      Commit 32fee1df
      
       ("usb: musb: remove unused davinci support")
      removed these implementations but leave declaration.
      
      Signed-off-by: default avatarYue Haibing <yuehaibing@huawei.com>
      Link: https://lore.kernel.org/r/20230807140928.35932-1-yuehaibing@huawei.com
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d4255ac3
    • Saranya Gopal's avatar
      usb: typec: ucsi: Add debugfs for ucsi commands · df0383ff
      Saranya Gopal authored
      
      
      Add support for UCSI commands through the following debugfs:
        # /sys/kernel/debug/usb/ucsi/$UCSI_DEVICE/command
        # /sys/kernel/debug/usb/ucsi/$UCSI_DEVICE/response
      
      Eg: To execute UCSI GetCapabilities:
        # echo 0x6 > /sys/kernel/debug/usb/ucsi/<ucsi device>/command
      Then read the result,
        # cat /sys/kernel/debug/usb/ucsi/<ucsi device>/response
          0x02000320000000020000ff0400000445
      
      UCSI command will be written into the command file and the
      response for the command can be viewed under the response file.
      
      Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarSaranya Gopal <saranya.gopal@intel.com>
      Co-developed-by: default avatarRajaram Regupathy <rajaram.regupathy@intel.com>
      Signed-off-by: default avatarRajaram Regupathy <rajaram.regupathy@intel.com>
      Reviewed-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
      Link: https://lore.kernel.org/r/20230807105205.742819-1-saranya.gopal@intel.com
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      df0383ff
    • Dan Drown's avatar
      usb: cdc-acm: add PPS support · 3b563b90
      Dan Drown authored
      
      
      This patch adds support for PPS to CDC devices. Changes to the DCD pin
      are monitored and passed to the ldisc system, which is used by
      pps-ldisc.
      
      Signed-off-by: default avatarDan Drown <dan-netdev@drown.org>
      Link: https://lore.kernel.org/r/ZM8ExV6bAvJtIA1d@vps3.drown.org
      
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3b563b90
  3. Aug 04, 2023
  4. Jul 31, 2023
    • Greg Kroah-Hartman's avatar
      Merge 6.5-rc4 into usb-next · 98a9e32b
      Greg Kroah-Hartman authored
      
      
      We need the USB fixes in here for testing and for other patches to be
      applied on top of.
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      98a9e32b
    • Linus Torvalds's avatar
      Linux 6.5-rc4 · 5d0c230f
      Linus Torvalds authored
      5d0c230f
    • Linus Torvalds's avatar
      Merge tag 'spi-fix-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · d5bb4b89
      Linus Torvalds authored
      Pull spi fixes from Mark Brown:
       "A bunch of fixes for the Qualcomm QSPI driver, fixing multiple issues
        with the newly added DMA mode - it had a number of issues exposed when
        tested in a wider range of use cases, both race condition style issues
        and issues with different inputs to those that had been used in test"
      
      * tag 'spi-fix-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: spi-qcom-qspi: Add mem_ops to avoid PIO for badly sized reads
        spi: spi-qcom-qspi: Fallback to PIO for xfers that aren't multiples of 4 bytes
        spi: spi-qcom-qspi: Add DMA_CHAIN_DONE to ALL_IRQS
        spi: spi-qcom-qspi: Call dma_wmb() after setting up descriptors
        spi: spi-qcom-qspi: Use GFP_ATOMIC flag while allocating for descriptor
        spi: spi-qcom-qspi: Ignore disabled interrupts' status in isr
      d5bb4b89
    • Linus Torvalds's avatar
      Merge tag 'regulator-fix-v6.5-rc3' of... · 3dfe6886
      Linus Torvalds authored
      Merge tag 'regulator-fix-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
      
      Pull regulator fixes from Mark Brown:
       "A couple of small fixes for the the mt6358 driver, fixing error
        reporting and a bootstrapping issue"
      
      * tag 'regulator-fix-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        regulator: mt6358: Fix incorrect VCN33 sync error message
        regulator: mt6358: Sync VCN33_* enable status after checking ID
      3dfe6886
    • Linus Torvalds's avatar
      Merge tag 'usb-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 88f66f13
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are a set of USB driver fixes for 6.5-rc4. Include in here are:
      
         - new USB serial device ids
      
         - dwc3 driver fixes for reported issues
      
         - typec driver fixes for reported problems
      
         - gadget driver fixes
      
         - reverts of some problematic USB changes that went into -rc1
      
        All of these have been in linux-next with no reported problems"
      
      * tag 'usb-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (24 commits)
        usb: misc: ehset: fix wrong if condition
        usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
        usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config
        usb: gadget: call usb_gadget_check_config() to verify UDC capability
        usb: typec: Use sysfs_emit_at when concatenating the string
        usb: typec: Iterate pds array when showing the pd list
        usb: typec: Set port->pd before adding device for typec_port
        usb: typec: qcom: fix return value check in qcom_pmic_typec_probe()
        Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()"
        Revert "usb: xhci: tegra: Fix error check"
        USB: gadget: Fix the memory leak in raw_gadget driver
        usb: gadget: core: remove unbalanced mutex_unlock in usb_gadget_activate
        Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
        Revert "xhci: add quirk for host controllers that don't update endpoint DCS"
        USB: quirks: add quirk for Focusrite Scarlett
        usb: xhci-mtk: set the dma max_seg_size
        MAINTAINERS: drop invalid usb/cdns3 Reviewer e-mail
        usb: dwc3: don't reset device side if dwc3 was configured as host-only
        usb: typec: ucsi: move typec_set_mode(TYPEC_STATE_SAFE) to ucsi_unregister_partner()
        usb: ohci-at91: Fix the unhandle interrupt when resume
        ...
      88f66f13
    • Linus Torvalds's avatar
      Merge tag 'tty-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · e6d34ced
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are some small TTY and serial driver fixes for 6.5-rc4 for some
        reported problems. Included in here is:
      
         - TIOCSTI fix for braille readers
      
         - documentation fix for minor numbers
      
         - MAINTAINERS update for new serial files in -rc1
      
         - minor serial driver fixes for reported problems
      
        All of these have been in linux-next with no reported problems"
      
      * tag 'tty-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: 8250_dw: Preserve original value of DLF register
        tty: serial: sh-sci: Fix sleeping in atomic context
        serial: sifive: Fix sifive_serial_console_setup() section
        Documentation: devices.txt: reconcile serial/ucc_uart minor numers
        MAINTAINERS: Update TTY layer for lists and recently added files
        tty: n_gsm: fix UAF in gsm_cleanup_mux
        TIOCSTI: always enable for CAP_SYS_ADMIN
      e6d34ced