[PATCH 1/2] usb: core: config: fix validation of wMaxPacketValue entries

[PATCH 1/2] usb: core: config: fix validation of wMaxPacketValue entries

[Pavel Hofman]

The checks performed by commit aed9d65ac327 ("USB: validate
wMaxPacketValue entries in endpoint descriptors") require that initial
value of the maxp variable contains both maximum packet size bits
(10..0) and multiple-transactions bits (12..11). However, the existing
code assings only the maximum packet size bits. This patch assigns all
bits of wMaxPacketSize to the variable.

Fixes: aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors")
Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
---
 drivers/usb/core/config.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index b199eb65f378..74eb356c8767 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -406,7 +406,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 	 * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0
 	 * (see the end of section 5.6.3), so don't warn about them.
 	 */
-	maxp = usb_endpoint_maxp(&endpoint->desc);
+	maxp = le16_to_cpu(endpoint->desc.wMaxPacketSize);
 	if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) {
 		dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n",
 		    cfgno, inum, asnum, d->bEndpointAddress);
-- 
2.25.1

[PATCH 2/2] usb: core: config: using bit mask instead of individual bits

[Pavel Hofman]

Using standard USB_EP_MAXP_MULT_MASK instead of individual bits for
extracting multiple-transactions bits from wMaxPacketSize value.

Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
---
 drivers/usb/core/config.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 74eb356c8767..00e28456e4cc 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -422,9 +422,9 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 		maxpacket_maxes = full_speed_maxpacket_maxes;
 		break;
 	case USB_SPEED_HIGH:
-		/* Bits 12..11 are allowed only for HS periodic endpoints */
+		/* Multiple-transactions bits are allowed only for HS periodic endpoints */
 		if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
-			i = maxp & (BIT(12) | BIT(11));
+			i = maxp & USB_EP_MAXP_MULT_MASK;
 			maxp &= ~i;
 		}
 		fallthrough;
-- 
2.25.1

Re: [PATCH 1/2] usb: core: config: fix validation of wMaxPacketValue entries

[Alan Stern]

On Fri, Dec 10, 2021 at 09:52:18AM +0100, Pavel Hofman wrote:
> The checks performed by commit aed9d65ac327 ("USB: validate
> wMaxPacketValue entries in endpoint descriptors") require that initial
> value of the maxp variable contains both maximum packet size bits
> (10..0) and multiple-transactions bits (12..11). However, the existing
> code assings only the maximum packet size bits. This patch assigns all
> bits of wMaxPacketSize to the variable.
> 
> Fixes: aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors")
> Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
> ---

Acked-by: Alan Stern <stern@rowland.harvard.edu>

This should have a "CC: <stable@vger.kernel.org>" tag attached.


>  drivers/usb/core/config.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
> index b199eb65f378..74eb356c8767 100644
> --- a/drivers/usb/core/config.c
> +++ b/drivers/usb/core/config.c
> @@ -406,7 +406,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
>  	 * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0
>  	 * (see the end of section 5.6.3), so don't warn about them.
>  	 */
> -	maxp = usb_endpoint_maxp(&endpoint->desc);
> +	maxp = le16_to_cpu(endpoint->desc.wMaxPacketSize);
>  	if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) {
>  		dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n",
>  		    cfgno, inum, asnum, d->bEndpointAddress);
> -- 
> 2.25.1
> 

Re: [PATCH 2/2] usb: core: config: using bit mask instead of individual bits

[Alan Stern]

On Fri, Dec 10, 2021 at 09:52:19AM +0100, Pavel Hofman wrote:
> Using standard USB_EP_MAXP_MULT_MASK instead of individual bits for
> extracting multiple-transactions bits from wMaxPacketSize value.
> 
> Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
> ---

Acked-by: Alan Stern <stern@rowland.harvard.edu>

>  drivers/usb/core/config.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
> index 74eb356c8767..00e28456e4cc 100644
> --- a/drivers/usb/core/config.c
> +++ b/drivers/usb/core/config.c
> @@ -422,9 +422,9 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
>  		maxpacket_maxes = full_speed_maxpacket_maxes;
>  		break;
>  	case USB_SPEED_HIGH:
> -		/* Bits 12..11 are allowed only for HS periodic endpoints */
> +		/* Multiple-transactions bits are allowed only for HS periodic endpoints */
>  		if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
> -			i = maxp & (BIT(12) | BIT(11));
> +			i = maxp & USB_EP_MAXP_MULT_MASK;
>  			maxp &= ~i;
>  		}
>  		fallthrough;
> -- 
> 2.25.1
> 

Re: [PATCH 1/2] usb: core: config: fix validation of wMaxPacketValue entries

[Greg Kroah-Hartman]

On Fri, Dec 10, 2021 at 10:48:21AM -0500, Alan Stern wrote:
> On Fri, Dec 10, 2021 at 09:52:18AM +0100, Pavel Hofman wrote:
> > The checks performed by commit aed9d65ac327 ("USB: validate
> > wMaxPacketValue entries in endpoint descriptors") require that initial
> > value of the maxp variable contains both maximum packet size bits
> > (10..0) and multiple-transactions bits (12..11). However, the existing
> > code assings only the maximum packet size bits. This patch assigns all
> > bits of wMaxPacketSize to the variable.
> > 
> > Fixes: aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors")
> > Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
> > ---
> 
> Acked-by: Alan Stern <stern@rowland.harvard.edu>
> 
> This should have a "CC: <stable@vger.kernel.org>" tag attached.

I can add that, thanks.

greg k-h