Bug 238412

Summary:

libusb_get_config_descriptor() should return LIBUSB_NOT_FOUND on out-of-range config_index

Product:

Base System

Reporter:

takahiro.kurosawa

Component:

usb

Assignee:

freebsd-usb (Nobody) <usb>

Status:

Closed FIXED

Severity:

Affects Only Me

CC:

hselasky

Priority:

---

Version:

11.3-STABLE

Hardware:

Any

OS:

Any

Attachments:

Description	Flags
proposed patch	none

Description takahiro.kurosawa 2019-06-08 04:23:14 UTC

Created attachment 204897 [details]
proposed patch

libusb_get_config_descriptor() in FreeBSD issues a get_config_descriptor       
request even if the config_index argument is out of range.  On the other       
hand, the function in Linux checks the config_index argument against           
bNumConfigurations in the device descriptor and returns LIBUSB_ERROR_NOT_FOUND 
without issuing get_config_descriptor requests.                                

It seems that get_config_descriptor requests with invalid config_index         
values for most USB devices fail, but there is a device (USB DrDAQ from        
Pico Technology) that does not check the config_index value.  The request      
for USB DrDAQ succeeds even if the config_index value is invalid.              
As a result, the behavior of libusb_get_config_descriptor() in FreeBSD         
differs from the one in Linux on such a device.                                
This makes qemu hang on FreeBSD with USB passthrough enabled because qemu      
repeats libusb_get_config_descriptor() with incrementing config_index until    
the function returns an error.

The specification of libusb_get_config_descriptor():                           
  http://libusb.sourceforge.net/api-1.0/group__libusb__desc.html#gaa635d9aec77d\e4895dd0896ccf001532
The implementation in Linux:
  https://github.com/libusb/libusb/blob/v1.0.22/libusb/descriptor.c#L625

Comment 1 commit-hook freebsd_committer

2019-06-08 09:34:16 UTC

A commit references this bug:

Author: hselasky
Date: Sat Jun  8 09:34:02 UTC 2019
New revision: 348797
URL: https://svnweb.freebsd.org/changeset/base/348797

Log:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412
  MFC after:	3 days

Changes:
  head/lib/libusb/libusb20.c

Comment 2 Hans Petter Selasky freebsd_committer

2019-06-08 09:34:37 UTC

Thanks!

Comment 3 commit-hook freebsd_committer

2019-06-11 08:51:17 UTC

A commit references this bug:

Author: hselasky
Date: Tue Jun 11 08:50:27 UTC 2019
New revision: 348893
URL: https://svnweb.freebsd.org/changeset/base/348893

Log:
  MFC r348797:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412
  Approved by:	re (kib)

Changes:
_U  stable/11/
  stable/11/lib/libusb/libusb20.c

Comment 4 commit-hook freebsd_committer

2019-06-11 08:53:21 UTC

A commit references this bug:

Author: hselasky
Date: Tue Jun 11 08:52:48 UTC 2019
New revision: 348894
URL: https://svnweb.freebsd.org/changeset/base/348894

Log:
  MFC r348797:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412

Changes:
_U  stable/12/
  stable/12/lib/libusb/libusb20.c

Comment 5 commit-hook freebsd_committer

2019-06-11 08:54:24 UTC

A commit references this bug:

Author: hselasky
Date: Tue Jun 11 08:53:26 UTC 2019
New revision: 348895
URL: https://svnweb.freebsd.org/changeset/base/348895

Log:
  MFC r348797:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412

Changes:
_U  stable/10/
  stable/10/lib/libusb/libusb20.c

Comment 6 commit-hook freebsd_committer

2019-06-11 08:55:27 UTC

A commit references this bug:

Author: hselasky
Date: Tue Jun 11 08:54:22 UTC 2019
New revision: 348896
URL: https://svnweb.freebsd.org/changeset/base/348896

Log:
  MFC r348797:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412

Changes:
_U  stable/9/lib/
_U  stable/9/lib/libusb/
  stable/9/lib/libusb/libusb20.c