From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: USB: Fix off by one in type-specific length check of BOS SSP capability From: Masakazu Mokuno Message-Id: <20171220023435.9B5C.F48FD4B1@gmail.com> Date: Wed, 20 Dec 2017 02:34:39 +0900 To: Mathias Nyman Cc: gregkh@linuxfoundation.org, linux-usb@vger.kernel.org, linux-stable List-ID: SGkgTWF0aGlhcywKCk9uIFR1ZSwgMTkgRGVjIDIwMTcgMTE6MTQ6NDIgKzAyMDAKTWF0aGlhcyBO eW1hbiA8bWF0aGlhcy5ueW1hbkBsaW51eC5pbnRlbC5jb20+IHdyb3RlOgoKPiBVU0IgMy4xIGRl dmljZXMgYXJlIG5vdCBkZXRlY3RlZCBhcyAzLjEgY2FwYWJsZSBzaW5jZSA0LjE1LXJjMyBkdWUg dG8gYQo+IG9mZiBieSBvbmUgaW4gY29tbWl0IDgxY2Y0YTQ1MzYwZiAoIlVTQjogY29yZTogQWRk IHR5cGUtc3BlY2lmaWMgbGVuZ3RoCj4gY2hlY2sgb2YgQk9TIGRlc2NyaXB0b3JzIikKPiAKPiBJ dCB1c2VzIFVTQl9EVF9VU0JfU1NQX0NBUF9TSVpFKCkgdG8gZ2V0IFNTUCBjYXBhYmlsaXR5IHNp emUgd2hpY2ggdGFrZXMKPiB0aGUgemVybyBiYXNlZCBTU0FDIGFzIGFyZ3VtZW50LCBub3QgdGhl IGFjdHVhbCBjb3VudCBvZiBzdWJsaW5rIHNwZWVkCj4gYXR0cmlidXRlcy4KPiAKPiBVU0IzIHNw ZWMgOS42LjIuNSBzYXlzICJUaGUgbnVtYmVyIG9mIFN1YmxpbmsgU3BlZWQgQXR0cmlidXRlcyA9 IFNTQUMgKyAxLiIKPiAKPiBUaGUgdHlwZS1zcGVjaWZpYyBsZW5ndGggY2hlY2sgcGF0Y2ggd2Fz IGFkZGVkIHRvIHN0YWJsZSBhbmQgbmVlZHMgdG8gYmUKPiBmaXhlZCB0aGVyZSBhcyB3ZWxsCj4g Cj4gRml4ZXM6IDgxY2Y0YTQ1MzYwZiAoIlVTQjogY29yZTogQWRkIHR5cGUtc3BlY2lmaWMgbGVu Z3RoIGNoZWNrIG9mIEJPUyBkZXNjcmlwdG9ycyIpCj4gQ2M6IGxpbnV4LXN0YWJsZSA8c3RhYmxl QHZnZXIua2VybmVsLm9yZz4KPiBDQzogTWFzYWthenUgTW9rdW5vIDxtYXNha2F6dS5tb2t1bm9A Z21haWwuY29tPgo+IFNpZ25lZC1vZmYtYnk6IE1hdGhpYXMgTnltYW4gPG1hdGhpYXMubnltYW5A bGludXguaW50ZWwuY29tPgo+IC0tLQo+ICBkcml2ZXJzL3VzYi9jb3JlL2NvbmZpZy5jIHwgMiAr LQo+ICAxIGZpbGUgY2hhbmdlZCwgMSBpbnNlcnRpb24oKyksIDEgZGVsZXRpb24oLSkKPiAKPiBk aWZmIC0tZ2l0IGEvZHJpdmVycy91c2IvY29yZS9jb25maWcuYyBiL2RyaXZlcnMvdXNiL2NvcmUv Y29uZmlnLmMKPiBpbmRleCA3OGU5MmQyLi5jODIxYjRiIDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMv dXNiL2NvcmUvY29uZmlnLmMKPiArKysgYi9kcml2ZXJzL3VzYi9jb3JlL2NvbmZpZy5jCj4gQEAg LTEwMDcsNyArMTAwNyw3IEBAIGludCB1c2JfZ2V0X2Jvc19kZXNjcmlwdG9yKHN0cnVjdCB1c2Jf ZGV2aWNlICpkZXYpCj4gIAkJY2FzZSBVU0JfU1NQX0NBUF9UWVBFOgo+ICAJCQlzc3BfY2FwID0g KHN0cnVjdCB1c2Jfc3NwX2NhcF9kZXNjcmlwdG9yICopYnVmZmVyOwo+ICAJCQlzc2FjID0gKGxl MzJfdG9fY3B1KHNzcF9jYXAtPmJtQXR0cmlidXRlcykgJgo+IC0JCQkJVVNCX1NTUF9TVUJMSU5L X1NQRUVEX0FUVFJJQlMpICsgMTsKPiArCQkJCVVTQl9TU1BfU1VCTElOS19TUEVFRF9BVFRSSUJT KTsKPiAgCQkJaWYgKGxlbmd0aCA+PSBVU0JfRFRfVVNCX1NTUF9DQVBfU0laRShzc2FjKSkKPiAg CQkJCWRldi0+Ym9zLT5zc3BfY2FwID0gc3NwX2NhcDsKPiAgCQkJYnJlYWs7Cj4gLS0gCj4gMi43 LjQKClRoYW5rcyBmb3IgdGhlIGZpeC4gIEkgZ290IGNvbmZ1c2VkIHRoZSBtZWFuaW5nIG9mIFVT Ql9EVF9VU0JfU1NQX0NBUF9TSVpFKCkKanVzdCBhcyB5b3UgZGVzY3JpYmVkLiAgVGhlIHNpemVv ZihzdHJ1Y3QgdXNiX3NzcF9jYXBfZGVzY3JpcHRvcikgaXMgMTYsCmJ1dCBJIGRpZCBub3Qgbm90 aWNlZCBpdCBpbmNsdWRlZCBvbmUgU1NBQy4KClRoZXJlJ3MgYW5vdGhlciBwbGFjZSB0aGF0IHdy b25nbHkgdXNlcyBVU0JfRFRfVVNCX1NTUF9DQVBfU0laRSgpIGluIG15CnByZXZpb3VzIHBhdGNo LiAgSXQgc2hvdWxkIGJlIGZpeGVkIGFsc28uICBJJ2xsIG1ha2UgdGhlIHBhdGNoLgo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg0-f65.google.com ([74.125.83.65]:37696 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750902AbdLSRek (ORCPT ); Tue, 19 Dec 2017 12:34:40 -0500 Date: Wed, 20 Dec 2017 02:34:39 +0900 From: Masakazu Mokuno To: Mathias Nyman Subject: Re: [PATCH] USB: Fix off by one in type-specific length check of BOS SSP capability Cc: , linux-usb@vger.kernel.org, linux-stable In-Reply-To: <1513674882-18422-1-git-send-email-mathias.nyman@linux.intel.com> References: <1513674882-18422-1-git-send-email-mathias.nyman@linux.intel.com> Message-Id: <20171220023435.9B5C.F48FD4B1@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Sender: stable-owner@vger.kernel.org List-ID: Hi Mathias, On Tue, 19 Dec 2017 11:14:42 +0200 Mathias Nyman wrote: > USB 3.1 devices are not detected as 3.1 capable since 4.15-rc3 due to a > off by one in commit 81cf4a45360f ("USB: core: Add type-specific length > check of BOS descriptors") > > It uses USB_DT_USB_SSP_CAP_SIZE() to get SSP capability size which takes > the zero based SSAC as argument, not the actual count of sublink speed > attributes. > > USB3 spec 9.6.2.5 says "The number of Sublink Speed Attributes = SSAC + 1." > > The type-specific length check patch was added to stable and needs to be > fixed there as well > > Fixes: 81cf4a45360f ("USB: core: Add type-specific length check of BOS descriptors") > Cc: linux-stable > CC: Masakazu Mokuno > Signed-off-by: Mathias Nyman > --- > drivers/usb/core/config.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c > index 78e92d2..c821b4b 100644 > --- a/drivers/usb/core/config.c > +++ b/drivers/usb/core/config.c > @@ -1007,7 +1007,7 @@ int usb_get_bos_descriptor(struct usb_device *dev) > case USB_SSP_CAP_TYPE: > ssp_cap = (struct usb_ssp_cap_descriptor *)buffer; > ssac = (le32_to_cpu(ssp_cap->bmAttributes) & > - USB_SSP_SUBLINK_SPEED_ATTRIBS) + 1; > + USB_SSP_SUBLINK_SPEED_ATTRIBS); > if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac)) > dev->bos->ssp_cap = ssp_cap; > break; > -- > 2.7.4 Thanks for the fix. I got confused the meaning of USB_DT_USB_SSP_CAP_SIZE() just as you described. The sizeof(struct usb_ssp_cap_descriptor) is 16, but I did not noticed it included one SSAC. There's another place that wrongly uses USB_DT_USB_SSP_CAP_SIZE() in my previous patch. It should be fixed also. I'll make the patch. -- Masakazu Mokuno