• M
    usbcore/driver: Fix specific driver selection · aea850cd
    M. Vefa Bicakci 提交于
    This commit resolves a bug in the selection/discovery of more
    specific USB device drivers for devices that are currently bound to
    generic USB device drivers.
    
    The bug is in the logic that determines whether a device currently
    bound to a generic USB device driver should be re-probed by a
    more specific USB device driver or not. The code in
    __usb_bus_reprobe_drivers() used to have the following lines:
    
      if (usb_device_match_id(udev, new_udriver->id_table) == NULL &&
          (!new_udriver->match || new_udriver->match(udev) != 0))
     		return 0;
    
      ret = device_reprobe(dev);
    
    As the reader will notice, the code checks whether the USB device in
    consideration matches the identifier table (id_table) of a specific
    USB device_driver (new_udriver), followed by a similar check, but this
    time with the USB device driver's match function. However, the match
    function's return value is not checked correctly. When match() returns
    zero, it means that the specific USB device driver is *not* applicable
    to the USB device in question, but the code then goes on to reprobe the
    device with the new USB device driver under consideration. All this to
    say, the logic is inverted.
    
    This bug was found by code inspection and instrumentation while
    investigating the root cause of the issue reported by Andrey Konovalov,
    where usbip took over syzkaller's virtual USB devices in an undesired
    manner. The report is linked below.
    
    Fixes: d5643d22 ("USB: Fix device driver race")
    Cc: <stable@vger.kernel.org> # 5.8
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Alan Stern <stern@rowland.harvard.edu>
    Cc: Bastien Nocera <hadess@hadess.net>
    Cc: Shuah Khan <shuah@kernel.org>
    Cc: Valentina Manea <valentina.manea.m@gmail.com>
    Cc: <syzkaller@googlegroups.com>
    Tested-by: NAndrey Konovalov <andreyknvl@google.com>
    Signed-off-by: NM. Vefa Bicakci <m.v.b@runbox.com>
    Link: https://lore.kernel.org/r/20200922110703.720960-3-m.v.b@runbox.comSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    aea850cd
driver.c 57.1 KB