LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Alan Stern <stern@rowland.harvard.edu>
To: syzbot <syzbot+9b57a46bf1801ce2a2ca@syzkaller.appspotmail.com>
Cc: benjamin.tissoires@redhat.com, jikos@kernel.org,
	linux-input@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-usb@vger.kernel.org, mkubecek@suse.cz,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] WARNING in hid_submit_ctrl/usb_submit_urb
Date: Fri, 20 Aug 2021 10:06:20 -0400	[thread overview]
Message-ID: <20210820140620.GA35867@rowland.harvard.edu> (raw)
In-Reply-To: <000000000000c322ab05c9f2e880@google.com>

On Thu, Aug 19, 2021 at 05:40:07PM -0700, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:

That's good to know.  Still, I suspect there's a better way of handling 
this condition.

In particular, does it make sense to accept descriptors for input or 
feature reports with length zero?  I can't imagine what good such 
reports would do.

On the other hand, I'm not familiar enough with the code to know the 
right way to reject these descriptors and reports.  It looks like the 
HID subsystem was not designed with this sort of check in mind.

Benjamin and Jiri, what do you think?  Is it okay to allow descriptors 
for zero-length reports and just pretend they have length 1 (as the 
patch tested by syzbot did), or should we instead reject them during 
probing?

Alan Stern

  reply	other threads:[~2021-08-20 14:06 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-18 15:46 syzbot
2021-08-18  9:14 ` syzbot
2021-08-18 18:49   ` Alan Stern
2021-08-18 20:13     ` syzbot
2021-08-19 15:26       ` Alan Stern
2021-08-19 17:35         ` syzbot
2021-08-19 19:53           ` Alan Stern
2021-08-20  0:40             ` syzbot
2021-08-20 14:06               ` Alan Stern [this message]
2021-08-24 11:53                 ` Jiri Kosina
2021-08-24 12:34                   ` Benjamin Tissoires
2021-08-31  9:51                   ` Benjamin Tissoires
2021-08-31 13:34                     ` Alan Stern
2021-08-31 19:53                       ` Jiri Kosina
2021-09-01 15:38                     ` Alan Stern
2021-09-01 15:51                       ` Michal Kubecek
2021-08-24 11:50             ` Michal Kubecek
2021-08-30 19:22             ` Oleksandr Natalenko
2021-08-18 19:01   ` Alan Stern
2021-08-18 19:39 ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210820140620.GA35867@rowland.harvard.edu \
    --to=stern@rowland.harvard.edu \
    --cc=benjamin.tissoires@redhat.com \
    --cc=jikos@kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=mkubecek@suse.cz \
    --cc=syzbot+9b57a46bf1801ce2a2ca@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --subject='Re: [syzbot] WARNING in hid_submit_ctrl/usb_submit_urb' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).