linux/drivers/usb
Hans de Goede 845d584f41 USB: devio: Revert "USB: devio: Don't corrupt user memory"
Taking the uurb->buffer_length userspace passes in as a maximum for the
actual urbs transfer_buffer_length causes 2 serious issues:

1) It breaks isochronous support for all userspace apps using libusb,
   as existing libusb versions pass in 0 for uurb->buffer_length,
   relying on the kernel using the lenghts of the usbdevfs_iso_packet_desc
   descriptors passed in added together as buffer length.

   This for example causes redirection of USB audio and Webcam's into
   virtual machines using qemu-kvm to no longer work. This is a userspace
   ABI break and as such must be reverted.

   Note that the original commit does not protect other users / the
   kernels memory, it only stops the userspace process making the call
   from shooting itself in the foot.

2) It may cause the kernel to program host controllers to DMA over random
   memory. Just as the devio code used to only look at the iso_packet_desc
   lenghts, the host drivers do the same, relying on the submitter of the
   urbs to make sure the entire buffer is large enough and not checking
   transfer_buffer_length.

   But the "USB: devio: Don't corrupt user memory" commit now takes the
   userspace provided uurb->buffer_length for the buffer-size while copying
   over the user-provided iso_packet_desc lengths 1:1, allowing the user
   to specify a small buffer size while programming the host controller to
   dma a lot more data.

   (Atleast the ohci, uhci, xhci and fhci drivers do not check
    transfer_buffer_length for isoc transfers.)

This reverts commit fa1ed74eb1 ("USB: devio: Don't corrupt user memory")
fixing both these issues.

Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-17 10:53:20 +02:00
..
atm usb: atm: ueagle-atm: constify attribute_group structures. 2017-08-10 11:31:28 -07:00
c67x00 c67x00-hcd: constify hc_driver structures 2017-07-30 07:26:52 -07:00
chipidea usb: chipidea: usb2: check memory allocation failure 2017-08-28 11:44:39 +02:00
class USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse 2017-09-25 10:57:13 +02:00
common usb: common: use of_property_read_bool() 2017-08-28 11:39:31 +02:00
core USB: devio: Revert "USB: devio: Don't corrupt user memory" 2017-10-17 10:53:20 +02:00
dwc2 usb: dwc2: skip L2 state of hcd if controller work in device mode 2017-08-15 14:18:55 +03:00
dwc3 usb: dwc3: of-simple: Add compatible for Spreadtrum SC9860 platform 2017-09-28 12:41:56 +03:00
early usb/early: Remove trace_printk() callers in xhci-dbc 2017-06-13 10:54:40 +02:00
gadget usb: gadget: configfs: Fix memory leak of interface directory data 2017-10-11 13:14:37 +03:00
host usb: xhci: Handle error condition in xhci_stop_device() 2017-10-17 10:38:13 +02:00
image USB: microtek: remove unneeded DRIVER_VERSION macro 2017-07-22 15:56:53 +02:00
isp1760 usb: isp1760: compress return logic into one line 2017-07-17 13:13:44 +02:00
misc usb: usbtest: fix NULL pointer dereference 2017-10-11 13:15:11 +03:00
mon sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h> 2017-03-02 08:42:32 +01:00
mtu3 usb: changes for v4.14 merge window 2017-08-22 13:16:06 -07:00
musb USB: musb: dsps: add explicit runtime resume at suspend 2017-08-28 10:51:56 +02:00
phy usb: phy: tegra: Fix phy suspend for UDC 2017-10-11 13:13:07 +03:00
renesas_usbhs usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet 2017-10-11 13:13:52 +03:00
serial USB: serial: console: fix use-after-free after failed setup 2017-10-09 12:33:31 +02:00
storage USB: uas: fix bug in handling of alternate settings 2017-09-22 18:29:00 +02:00
typec usb: typec: include linux/device.h in ucsi.h 2017-07-17 13:11:56 +02:00
usbip usbip: vhci-hcd: make vhci_hc_driver const 2017-08-31 18:08:47 +02:00
wusbcore usb: wusbcore: dev-sysfs: constify attribute_group structures. 2017-08-10 11:31:27 -07:00
Kconfig usb: USB Type-C connector class 2017-03-23 13:48:44 +01:00
Makefile USB patches for 4.12-rc1 2017-05-04 18:03:51 -07:00
README
usb-skeleton.c USB: usb-skeleton: refactor endpoint retrieval 2017-03-23 13:54:08 +01:00

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.