Bug 238412

Summary: libusb_get_config_descriptor() should return LIBUSB_NOT_FOUND on out-of-range config_index
Product: Base System Reporter: takahiro.kurosawa
Component: usbAssignee: freebsd-usb mailing list <usb>
Status: Closed FIXED    
Severity: Affects Only Me CC: hselasky
Priority: ---    
Version: 11.3-STABLE   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
proposed patch none

Description takahiro.kurosawa 2019-06-08 04:23:14 UTC
Created attachment 204897 [details]
proposed patch

libusb_get_config_descriptor() in FreeBSD issues a get_config_descriptor       
request even if the config_index argument is out of range.  On the other       
hand, the function in Linux checks the config_index argument against           
bNumConfigurations in the device descriptor and returns LIBUSB_ERROR_NOT_FOUND 
without issuing get_config_descriptor requests.                                

It seems that get_config_descriptor requests with invalid config_index         
values for most USB devices fail, but there is a device (USB DrDAQ from        
Pico Technology) that does not check the config_index value.  The request      
for USB DrDAQ succeeds even if the config_index value is invalid.              
As a result, the behavior of libusb_get_config_descriptor() in FreeBSD         
differs from the one in Linux on such a device.                                
This makes qemu hang on FreeBSD with USB passthrough enabled because qemu      
repeats libusb_get_config_descriptor() with incrementing config_index until    
the function returns an error.

The specification of libusb_get_config_descriptor():                           
  http://libusb.sourceforge.net/api-1.0/group__libusb__desc.html#gaa635d9aec77d\e4895dd0896ccf001532
The implementation in Linux:
  https://github.com/libusb/libusb/blob/v1.0.22/libusb/descriptor.c#L625
Comment 1 commit-hook freebsd_committer 2019-06-08 09:34:16 UTC
A commit references this bug:

Author: hselasky
Date: Sat Jun  8 09:34:02 UTC 2019
New revision: 348797
URL: https://svnweb.freebsd.org/changeset/base/348797

Log:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412
  MFC after:	3 days

Changes:
  head/lib/libusb/libusb20.c
Comment 2 Hans Petter Selasky freebsd_committer 2019-06-08 09:34:37 UTC
Thanks!
Comment 3 commit-hook freebsd_committer 2019-06-11 08:51:17 UTC
A commit references this bug:

Author: hselasky
Date: Tue Jun 11 08:50:27 UTC 2019
New revision: 348893
URL: https://svnweb.freebsd.org/changeset/base/348893

Log:
  MFC r348797:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412
  Approved by:	re (kib)

Changes:
_U  stable/11/
  stable/11/lib/libusb/libusb20.c
Comment 4 commit-hook freebsd_committer 2019-06-11 08:53:21 UTC
A commit references this bug:

Author: hselasky
Date: Tue Jun 11 08:52:48 UTC 2019
New revision: 348894
URL: https://svnweb.freebsd.org/changeset/base/348894

Log:
  MFC r348797:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412

Changes:
_U  stable/12/
  stable/12/lib/libusb/libusb20.c
Comment 5 commit-hook freebsd_committer 2019-06-11 08:54:24 UTC
A commit references this bug:

Author: hselasky
Date: Tue Jun 11 08:53:26 UTC 2019
New revision: 348895
URL: https://svnweb.freebsd.org/changeset/base/348895

Log:
  MFC r348797:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412

Changes:
_U  stable/10/
  stable/10/lib/libusb/libusb20.c
Comment 6 commit-hook freebsd_committer 2019-06-11 08:55:27 UTC
A commit references this bug:

Author: hselasky
Date: Tue Jun 11 08:54:22 UTC 2019
New revision: 348896
URL: https://svnweb.freebsd.org/changeset/base/348896

Log:
  MFC r348797:
  Fix for reading the configuration descriptor in libusb. Catch invalid
  configuration descriptor reads early on to avoid issues with devices
  that don't check for a valid USB configuration read request.

  Submitted by:	takahiro.kurosawa@gmail.com
  PR:		238412

Changes:
_U  stable/9/lib/
_U  stable/9/lib/libusb/
  stable/9/lib/libusb/libusb20.c