1. 30 6月, 2017 1 次提交
  2. 02 3月, 2017 1 次提交
  3. 28 2月, 2017 1 次提交
  4. 11 1月, 2017 1 次提交
  5. 28 9月, 2016 1 次提交
  6. 24 8月, 2016 1 次提交
    • A
      USB: avoid left shift by -1 · 53e5f36f
      Alan Stern 提交于
      UBSAN complains about a left shift by -1 in proc_do_submiturb().  This
      can occur when an URB is submitted for a bulk or control endpoint on
      a high-speed device, since the code doesn't bother to check the
      endpoint type; normally only interrupt or isochronous endpoints have
      a nonzero bInterval value.
      
      Aside from the fact that the operation is illegal, it shouldn't matter
      because the result isn't used.  Still, in theory it could cause a
      hardware exception or other problem, so we should work around it.
      This patch avoids doing the left shift unless the shift amount is >= 0.
      
      The same piece of code has another problem.  When checking the device
      speed (the exponential encoding for interrupt endpoints is used only
      by high-speed or faster devices), we need to look for speed >=
      USB_SPEED_SUPER as well as speed == USB_SPEED HIGH.  The patch adds
      this check.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Reported-by: NVittorio Zecca <zeccav@gmail.com>
      Tested-by: NVittorio Zecca <zeccav@gmail.com>
      Suggested-by: NBjørn Mork <bjorn@mork.no>
      CC: <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      53e5f36f
  7. 09 8月, 2016 2 次提交
    • A
      USB: remove race condition in usbfs/libusb when using reap-after-disconnect · 5cce4382
      Alan Stern 提交于
      Hans de Goede has reported a difficulty in the Linux port of libusb.
      When a device is removed, the poll() system call in usbfs starts
      returning POLLERR as soon as udev->state is set to
      USB_STATE_NOTATTACHED, but the outstanding URBs are not available for
      reaping until some time later (after usbdev_remove() has been called).
      This is awkward for libusb or other usbfs clients, although not an
      insuperable problem.
      
      At any rate, it's easy to change usbfs so that it returns POLLHUP as
      soon as the state becomes USB_STATE_NOTATTACHED but it doesn't return
      POLLERR until after the outstanding URBs have completed.  That's what
      this patch does; it uses the fact that ps->list is always on the
      dev->filelist list until usbdev_remove() takes it off, which happens
      after all the outstanding URBs have been cancelled.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Reported-by: NHans de Goede <hdegoede@redhat.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5cce4382
    • J
      usb: devio, do not warn when allocation fails · 70f7ca9a
      Jiri Slaby 提交于
      usbdev_mmap allocates a buffer. The size of the buffer is determined
      by a user. So with this code (no need to be root):
      
      	int fd = open("/dev/bus/usb/001/001", O_RDONLY);
      	mmap(NULL, 0x800000, PROT_READ, MAP_SHARED, fd, 0);
      
      we can see a warning:
      
      WARNING: CPU: 0 PID: 21771 at ../mm/page_alloc.c:3563 __alloc_pages_slowpath+0x1036/0x16e0()
      ...
      Call Trace:
       [<ffffffff8117a3ae>] ? warn_slowpath_null+0x2e/0x40
       [<ffffffff815178b6>] ? __alloc_pages_slowpath+0x1036/0x16e0
       [<ffffffff81516880>] ? warn_alloc_failed+0x250/0x250
       [<ffffffff8151226b>] ? get_page_from_freelist+0x75b/0x28b0
       [<ffffffff815184e3>] ? __alloc_pages_nodemask+0x583/0x6b0
       [<ffffffff81517f60>] ? __alloc_pages_slowpath+0x16e0/0x16e0
       [<ffffffff810565d4>] ? dma_generic_alloc_coherent+0x104/0x220
       [<ffffffffa0269e56>] ? hcd_buffer_alloc+0x1d6/0x3e0 [usbcore]
       [<ffffffffa0269c80>] ? hcd_buffer_destroy+0xa0/0xa0 [usbcore]
       [<ffffffffa0228f05>] ? usb_alloc_coherent+0x65/0x90 [usbcore]
       [<ffffffffa0275c05>] ? usbdev_mmap+0x1a5/0x770 [usbcore]
      ...
      
      Allocations like this one should be marked as __GFP_NOWARN. So do so.
      
      The size could be also clipped by something like:
      	if (size >= (1 << (MAX_ORDER + PAGE_SHIFT - 1)))
      		return -ENOMEM;
      But I think the overall limit of 16M (by usbfs_increase_memory_usage)
      is enough, so that we only silence the warning here.
      Signed-off-by: NJiri Slaby <jslaby@suse.cz>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: Steinar H. Gunderson <sesse@google.com>
      Cc: Markus Rechberger <mrechberger@gmail.com>
      Fixes: f7d34b44 (USB: Add support for usbfs zerocopy.)
      Cc: 4.6+ <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      70f7ca9a
  8. 04 5月, 2016 1 次提交
  9. 29 4月, 2016 1 次提交
  10. 06 3月, 2016 1 次提交
    • R
      usb: devio: Add ioctl to disallow detaching kernel USB drivers. · d883f52e
      Reilly Grant 提交于
      The new USBDEVFS_DROP_PRIVILEGES ioctl allows a process to voluntarily
      relinquish the ability to issue other ioctls that may interfere with
      other processes and drivers that have claimed an interface on the
      device.
      
      This commit also includes a simple utility to be able to test the
      ioctl, located at Documentation/usb/usbdevfs-drop-permissions.c
      
      Example (with qemu-kvm's input device):
      
          $ lsusb
          ...
          Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd
      
          $ usb-devices
          ...
          C:  #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=100mA
          I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=02 Driver=usbhid
      
          $ sudo ./usbdevfs-drop-permissions /dev/bus/usb/001/002
          OK: privileges dropped!
          Available options:
          [0] Exit now
          [1] Reset device. Should fail if device is in use
          [2] Claim 4 interfaces. Should succeed where not in use
          [3] Narrow interface permission mask
          Which option shall I run?: 1
          ERROR: USBDEVFS_RESET failed! (1 - Operation not permitted)
          Which test shall I run next?: 2
          ERROR claiming if 0 (1 - Operation not permitted)
          ERROR claiming if 1 (1 - Operation not permitted)
          ERROR claiming if 2 (1 - Operation not permitted)
          ERROR claiming if 3 (1 - Operation not permitted)
          Which test shall I run next?: 0
      
      After unbinding usbhid:
      
          $ usb-devices
          ...
          I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=02 Driver=(none)
      
          $ sudo ./usbdevfs-drop-permissions /dev/bus/usb/001/002
          ...
          Which option shall I run?: 2
          OK: claimed if 0
          ERROR claiming if 1 (1 - Operation not permitted)
          ERROR claiming if 2 (1 - Operation not permitted)
          ERROR claiming if 3 (1 - Operation not permitted)
          Which test shall I run next?: 1
          OK: USBDEVFS_RESET succeeded
          Which test shall I run next?: 0
      
      After unbinding usbhid and restricting the mask:
      
          $ sudo ./usbdevfs-drop-permissions /dev/bus/usb/001/002
          ...
          Which option shall I run?: 3
          Insert new mask: 0
          OK: privileges dropped!
          Which test shall I run next?: 2
          ERROR claiming if 0 (1 - Operation not permitted)
          ERROR claiming if 1 (1 - Operation not permitted)
          ERROR claiming if 2 (1 - Operation not permitted)
          ERROR claiming if 3 (1 - Operation not permitted)
      Signed-off-by: NReilly Grant <reillyg@chromium.org>
      Acked-by: NAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: NEmilio López <emilio.lopez@collabora.co.uk>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d883f52e
  11. 15 2月, 2016 1 次提交
    • S
      USB: Add support for usbfs zerocopy. · f7d34b44
      Steinar H. Gunderson 提交于
      Add a new interface for userspace to preallocate memory that can be
      used with usbfs. This gives two primary benefits:
      
       - Zerocopy; data no longer needs to be copied between the userspace
         and the kernel, but can instead be read directly by the driver from
         userspace's buffers. This works for all kinds of transfers (even if
         nonsensical for control and interrupt transfers); isochronous also
         no longer need to memset() the buffer to zero to avoid leaking kernel data.
      
       - Once the buffers are allocated, USB transfers can no longer fail due to
         memory fragmentation; previously, long-running programs could run into
         problems finding a large enough contiguous memory chunk, especially on
         embedded systems or at high rates.
      
      Memory is allocated by using mmap() against the usbfs file descriptor,
      and similarly deallocated by munmap(). Once memory has been allocated,
      using it as pointers to a bulk or isochronous operation means you will
      automatically get zerocopy behavior. Note that this also means you cannot
      modify outgoing data until the transfer is complete. The same holds for
      data on the same cache lines as incoming data; DMA modifying them at the
      same time could lead to your changes being overwritten.
      
      There's a new capability USBDEVFS_CAP_MMAP that userspace can query to see
      if the running kernel supports this functionality, if just trying mmap() is
      not acceptable.
      
      Largely based on a patch by Markus Rechberger with some updates. The original
      patch can be found at:
      
        http://sundtek.de/support/devio_mmap_v0.4.diffSigned-off-by: NSteinar H. Gunderson <sesse@google.com>
      Signed-off-by: NMarkus Rechberger <mrechberger@gmail.com>
      Acked-by: NAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f7d34b44
  12. 25 1月, 2016 3 次提交
  13. 23 12月, 2015 1 次提交
  14. 02 12月, 2015 2 次提交
    • A
      USB: add usbfs snooping for REAP and DISCARD · a016a816
      Alan Stern 提交于
      This patch improves the usbfs_snoop debugging facility by adding
      messages for a couple of significant events which, up to now, have not
      been logged.  The events are reaping and discarding (i.e.,
      cancelling) an URB.  The debugging messages include the userspace
      address of the URB being reaped or discarded.
      
      The reaping messages have to be added in four places, in order to
      handle blocking and non-blocking reaps in both normal and 32-bit
      compatibility mode.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      a016a816
    • A
      USB: limit usbfs snooping of URB contents · 0290cc9f
      Alan Stern 提交于
      The usbfs_snoop facility can be very useful for debugging problems
      involving usbfs.  However, it always prints out the entire contents of
      every URB.  When dealing with large quantities of data, this can be
      less than helpful.
      
      This patch ameliorates the situation by adding a module parameter to
      usbcore for controlling the maximum number of bytes to print when
      snooping an URB.  This makes debugging much easier.  For backward
      compatibility, the default value is set unreasonably high.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      0290cc9f
  15. 09 8月, 2015 1 次提交
  16. 06 8月, 2015 1 次提交
  17. 25 5月, 2015 1 次提交
  18. 10 4月, 2015 1 次提交
  19. 25 2月, 2015 1 次提交
  20. 01 2月, 2015 1 次提交
  21. 02 8月, 2014 1 次提交
  22. 11 3月, 2014 1 次提交
  23. 05 3月, 2014 5 次提交
  24. 25 2月, 2014 1 次提交
    • A
      USB: complain if userspace resets an active endpoint · f080a51b
      Alan Stern 提交于
      It is an error for a driver to call usb_clear_halt() or
      usb_reset_endpoint() while there are URBs queued for the endpoint,
      because the end result is not well defined.  At the time the endpoint
      gets reset, it may or may not be actively running.
      
      As far as I know, no kernel drivers do this.  But some userspace
      drivers do, and it seems like a good idea to bring this error to their
      attention.
      
      This patch adds a warning to the kernel log whenever a program invokes
      the USBDEVFS_CLEAR_HALT or USBDEVFS_RESETEP ioctls at an inappropriate
      time, and includes the name of the program.  This will make it clear
      that any subsequent errors are not due to the misbehavior of a kernel
      driver.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Suggested-by: NBjørn Mork <bjorn@mork.no>
      CC: Stanislaw Gruszka <sgruszka@redhat.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f080a51b
  25. 08 1月, 2014 1 次提交
  26. 17 10月, 2013 2 次提交
  27. 26 9月, 2013 1 次提交
    • K
      usb/core/devio.c: Don't reject control message to endpoint with wrong direction bit · 831abf76
      Kurt Garloff 提交于
      Trying to read data from the Pegasus Technologies NoteTaker (0e20:0101)
      [1] with the Windows App (EasyNote) works natively but fails when
      Windows is running under KVM (and the USB device handed to KVM).
      
      The reason is a USB control message
       usb 4-2.2: control urb: bRequestType=22 bRequest=09 wValue=0200 wIndex=0001 wLength=0008
      This goes to endpoint address 0x01 (wIndex); however, endpoint address
      0x01 does not exist. There is an endpoint 0x81 though (same number,
      but other direction); the app may have meant that endpoint instead.
      
      The kernel thus rejects the IO and thus we see the failure.
      
      Apparently, Linux is more strict here than Windows ... we can't change
      the Win app easily, so that's a problem.
      
      It seems that the Win app/driver is buggy here and the driver does not
      behave fully according to the USB HID class spec that it claims to
      belong to.  The device seems to happily deal with that though (and
      seems to not really care about this value much).
      
      So the question is whether the Linux kernel should filter here.
      Rejecting has the risk that somewhat non-compliant userspace apps/
      drivers (most likely in a virtual machine) are prevented from working.
      Not rejecting has the risk of confusing an overly sensitive device with
      such a transfer. Given the fact that Windows does not filter it makes
      this risk rather small though.
      
      The patch makes the kernel more tolerant: If the endpoint address in
      wIndex does not exist, but an endpoint with toggled direction bit does,
      it will let the transfer through. (It does NOT change the message.)
      
      With attached patch, the app in Windows in KVM works.
       usb 4-2.2: check_ctrlrecip: process 13073 (qemu-kvm) requesting ep 01 but needs 81
      
      I suspect this will mostly affect apps in virtual environments; as on
      Linux the apps would have been adapted to the stricter handling of the
      kernel. I have done that for mine[2].
      
      [1] http://www.pegatech.com/
      [2] https://sourceforge.net/projects/notetakerpen/Signed-off-by: NKurt Garloff <kurt@garloff.de>
      Acked-by: NAlan Stern <stern@rowland.harvard.edu>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      831abf76
  28. 18 9月, 2013 1 次提交
  29. 26 7月, 2013 1 次提交
    • H
      usbfs: Allow printer class 'get_device_id' without needing to claim the intf · 5dc50c35
      Hans de Goede 提交于
      For certain (HP) printers the printer device_id does not only contain a
      static part identifying the printer, but it also contains a dynamic part
      giving printer status, ink level, etc.
      
      To get to this info various userspace utilities need to be able to make a
      printer class 'get_device_id' request without first claiming the interface
      (as that is in use for the actual printer driver).
      
      Since the printer class 'get_device_id' request does not change interface
      settings in anyway, allowing this without claiming the interface should not
      cause any issues.
      
      CC: Sanjay Kumar <sanjay.kumar14@hp.com>
      CC: Alan Stern <stern@rowland.harvard.edu>
      Signed-off-by: NHans de Goede <hdegoede@redhat.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5dc50c35
  30. 29 5月, 2013 1 次提交
  31. 18 5月, 2013 1 次提交