RE: USB vulnerability

2016-08-02 Thread David Laight
From: Felipe Balbi > Sent: 29 July 2016 01:30 ... > > - maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff; > > usb_endpoint_maxp() should probably be updated to return only maximum > packet size. Then we would need to introduce usb_endpoint_mult() or > something along those lines to tak

Re: USB vulnerability

2016-07-29 Thread roswest
On Thu Jul 28 2016 15:56:17 GMT-0400 (EDT), Alan Stern wrote: > On Thu, 28 Jul 2016, Alan Stern wrote: > >> Only bits 10..0 of the wMaxPacketSize field contain the maximum packet >> size; bits 12..11 contain something else (valid only for high-speed >> periodic endpoints) and bits 15..13 are res

Re: USB vulnerability

2016-07-29 Thread Alan Stern
On Fri, 29 Jul 2016, Felipe Balbi wrote: > Hi, > > Alan Stern writes: > > On Fri, 29 Jul 2016, Felipe Balbi wrote: > > > >> slightly unrelated, but... > > > >> > -maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff; > >> > >> usb_endpoint_maxp() should probably be updated to retu

Re: USB vulnerability

2016-07-29 Thread Felipe Balbi
Hi, Alan Stern writes: > On Fri, 29 Jul 2016, Felipe Balbi wrote: > >> slightly unrelated, but... > >> > - maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff; >> >> usb_endpoint_maxp() should probably be updated to return only maximum >> packet size. Then we would need to introduce usb

Re: USB vulnerability

2016-07-29 Thread Alan Stern
On Fri, 29 Jul 2016, Felipe Balbi wrote: > slightly unrelated, but... > > - maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff; > > usb_endpoint_maxp() should probably be updated to return only maximum > packet size. Then we would need to introduce usb_endpoint_mult() or > something al

Re: USB vulnerability

2016-07-29 Thread Felipe Balbi
Hi, Alan Stern writes: > On Thu, 28 Jul 2016, Alan Stern wrote: > >> Only bits 10..0 of the wMaxPacketSize field contain the maximum packet >> size; bits 12..11 contain something else (valid only for high-speed >> periodic endpoints) and bits 15..13 are reserved (see Table 9-13 in the >> USB-2.0

Re: USB vulnerability

2016-07-29 Thread Felipe Balbi
Hi, roswest writes: > [ Unknown signature status ] > > Alan, > > Hi, I am an engineer at Cisco Systems, and this summer we tasked some > interns with performing USB fuzzing. One of the interns, Jake Lamberson, > was able to cause a kernel panic when emulating an HID keyboard because > the OHCI d

Re: USB vulnerability

2016-07-28 Thread Greg KH
On Thu, Jul 28, 2016 at 04:01:53PM -0400, Alan Stern wrote: > On Thu, 28 Jul 2016, Alan Stern wrote: > > > On Thu, 28 Jul 2016, Greg KH wrote: > > > > > On Thu, Jul 28, 2016 at 12:23:01PM -0400, roswest wrote: > > > > > > > > Alan, > > > > > > > > Hi, I am an engineer at Cisco Systems, and this

Re: USB vulnerability

2016-07-28 Thread Alan Stern
On Thu, 28 Jul 2016, Alan Stern wrote: > On Thu, 28 Jul 2016, Greg KH wrote: > > > On Thu, Jul 28, 2016 at 12:23:01PM -0400, roswest wrote: > > > > > > Alan, > > > > > > Hi, I am an engineer at Cisco Systems, and this summer we tasked some > > > interns with performing USB fuzzing. One of the i

Re: USB vulnerability

2016-07-28 Thread Alan Stern
On Thu, 28 Jul 2016, Alan Stern wrote: > Only bits 10..0 of the wMaxPacketSize field contain the maximum packet > size; bits 12..11 contain something else (valid only for high-speed > periodic endpoints) and bits 15..13 are reserved (see Table 9-13 in the > USB-2.0 spec). > > Furthermore, the val

Re: USB vulnerability

2016-07-28 Thread roswest
Greg, Oops message attached. Rosie Hall On Thu Jul 28 2016 12:45:06 GMT-0400 (EDT), Greg KH wrote: > On Thu, Jul 28, 2016 at 12:23:01PM -0400, roswest wrote: >> >> Alan, >> >> Hi, I am an engineer at Cisco Systems, and this summer we tasked some >> interns with performing USB fuzzing. One of the

Re: USB vulnerability

2016-07-28 Thread Alan Stern
On Thu, 28 Jul 2016, Greg KH wrote: > On Thu, Jul 28, 2016 at 12:23:01PM -0400, roswest wrote: > > > > Alan, > > > > Hi, I am an engineer at Cisco Systems, and this summer we tasked some > > interns with performing USB fuzzing. One of the interns, Jake Lamberson, > > was able to cause a kernel p

Re: USB vulnerability

2016-07-28 Thread Greg KH
On Thu, Jul 28, 2016 at 12:23:01PM -0400, roswest wrote: > > Alan, > > Hi, I am an engineer at Cisco Systems, and this summer we tasked some > interns with performing USB fuzzing. One of the interns, Jake Lamberson, > was able to cause a kernel panic when emulating an HID keyboard because > the O