Re: USB Denial Of Service

[Oliver Neukum <oneukum@suse.com>]

On 11.06.24 21:09, Alan Stern wrote:

> Alternatively, the driver could avoid resubmitting the URB when one of
> those errors occurs.  This is perhaps less appropriate, because these
> kinds of errors can be transient (although that is normally rare).

Optimally we'd wait a small delay and resubmit after that for a limited
number of attempts. In fact optimally we'd add helpers to do so for
all drivers to use.

However, to make this wor with suspend, reset and disconnect would
take work. Is a corner case worth that?

> Index: usb-devel/drivers/usb/class/cdc-wdm.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/class/cdc-wdm.c
> +++ usb-devel/drivers/usb/class/cdc-wdm.c
> @@ -266,14 +266,14 @@ static void wdm_int_callback(struct urb
>   			dev_err(&desc->intf->dev, "Stall on int endpoint\n");
>   			goto sw; /* halt is cleared in work */
>   		default:
> -			dev_err(&desc->intf->dev,
> +			dev_dbg(&desc->intf->dev,

Good idea.

>   				"nonzero urb status received: %d\n", status);
>   			break;
>   		}
>   	}
>   
>   	if (urb->actual_length < sizeof(struct usb_cdc_notification)) {
> -		dev_err(&desc->intf->dev, "wdm_int_callback - %d bytes\n",
> +		dev_dbg(&desc->intf->dev, "wdm_int_callback - %d bytes\n",

Not so good idea. If that happens it points to either a bug in the firmware
or a malicious device. Such things need to be logged.

	Regards
		Oliver