1 // SPDX-License-Identifier: GPL-2.0+
2 /*****************************************************************************/
3
4 /*
5 * devio.c -- User space communication with USB devices.
6 *
7 * Copyright (C) 1999-2000 Thomas Sailer (sailer@ife.ee.ethz.ch)
8 *
9 * This file implements the usbfs/x/y files, where
10 * x is the bus number and y the device number.
11 *
12 * It allows user space programs/"drivers" to communicate directly
13 * with USB devices without intervening kernel driver.
14 *
15 * Revision history
16 * 22.12.1999 0.1 Initial release (split from proc_usb.c)
17 * 04.01.2000 0.2 Turned into its own filesystem
18 * 30.09.2005 0.3 Fix user-triggerable oops in async URB delivery
19 * (CAN-2005-3055)
20 */
21
22 /*****************************************************************************/
23
24 #include <linux/fs.h>
25 #include <linux/mm.h>
26 #include <linux/sched/signal.h>
27 #include <linux/slab.h>
28 #include <linux/signal.h>
29 #include <linux/poll.h>
30 #include <linux/module.h>
31 #include <linux/string.h>
32 #include <linux/usb.h>
33 #include <linux/usbdevice_fs.h>
34 #include <linux/usb/hcd.h> /* for usbcore internals */
35 #include <linux/usb/quirks.h>
36 #include <linux/cdev.h>
37 #include <linux/notifier.h>
38 #include <linux/security.h>
39 #include <linux/user_namespace.h>
40 #include <linux/scatterlist.h>
41 #include <linux/uaccess.h>
42 #include <linux/dma-mapping.h>
43 #include <asm/byteorder.h>
44 #include <linux/moduleparam.h>
45
46 #include "usb.h"
47
48 #ifdef CONFIG_PM
49 #define MAYBE_CAP_SUSPEND USBDEVFS_CAP_SUSPEND
50 #else
51 #define MAYBE_CAP_SUSPEND 0
52 #endif
53
54 #define USB_MAXBUS 64
55 #define USB_DEVICE_MAX (USB_MAXBUS * 128)
56 #define USB_SG_SIZE 16384 /* split-size for large txs */
57
58 /* Mutual exclusion for ps->list in resume vs. release and remove */
59 static DEFINE_MUTEX(usbfs_mutex);
60
61 struct usb_dev_state {
62 struct list_head list; /* state list */
63 struct usb_device *dev;
64 struct file *file;
65 spinlock_t lock; /* protects the async urb lists */
66 struct list_head async_pending;
67 struct list_head async_completed;
68 struct list_head memory_list;
69 wait_queue_head_t wait; /* wake up if a request completed */
70 wait_queue_head_t wait_for_resume; /* wake up upon runtime resume */
71 unsigned int discsignr;
72 struct pid *disc_pid;
73 const struct cred *cred;
74 sigval_t disccontext;
75 unsigned long ifclaimed;
76 u32 disabled_bulk_eps;
77 unsigned long interface_allowed_mask;
78 int not_yet_resumed;
79 bool suspend_allowed;
80 bool privileges_dropped;
81 };
82
83 struct usb_memory {
84 struct list_head memlist;
85 int vma_use_count;
86 int urb_use_count;
87 u32 size;
88 void *mem;
89 dma_addr_t dma_handle;
90 unsigned long vm_start;
91 struct usb_dev_state *ps;
92 };
93
94 struct async {
95 struct list_head asynclist;
96 struct usb_dev_state *ps;
97 struct pid *pid;
98 const struct cred *cred;
99 unsigned int signr;
100 unsigned int ifnum;
101 void __user *userbuffer;
102 void __user *userurb;
103 sigval_t userurb_sigval;
104 struct urb *urb;
105 struct usb_memory *usbm;
106 unsigned int mem_usage;
107 int status;
108 u8 bulk_addr;
109 u8 bulk_status;
110 };
111
112 static bool usbfs_snoop;
113 module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);
114 MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
115
116 static unsigned usbfs_snoop_max = 65536;
117 module_param(usbfs_snoop_max, uint, S_IRUGO | S_IWUSR);
118 MODULE_PARM_DESC(usbfs_snoop_max,
119 "maximum number of bytes to print while snooping");
120
121 #define snoop(dev, format, arg...) \
122 do { \
123 if (usbfs_snoop) \
124 dev_info(dev, format, ## arg); \
125 } while (0)
126
127 enum snoop_when {
128 SUBMIT, COMPLETE
129 };
130
131 #define USB_DEVICE_DEV MKDEV(USB_DEVICE_MAJOR, 0)
132
133 /* Limit on the total amount of memory we can allocate for transfers */
134 static u32 usbfs_memory_mb = 16;
135 module_param(usbfs_memory_mb, uint, 0644);
136 MODULE_PARM_DESC(usbfs_memory_mb,
137 "maximum MB allowed for usbfs buffers (0 = no limit)");
138
139 /* Hard limit, necessary to avoid arithmetic overflow */
140 #define USBFS_XFER_MAX (UINT_MAX / 2 - 1000000)
141
142 static atomic64_t usbfs_memory_usage; /* Total memory currently allocated */
143
144 /* Check whether it's okay to allocate more memory for a transfer */
usbfs_increase_memory_usage(u64 amount)145 static int usbfs_increase_memory_usage(u64 amount)
146 {
147 u64 lim;
148
149 lim = READ_ONCE(usbfs_memory_mb);
150 lim <<= 20;
151
152 atomic64_add(amount, &usbfs_memory_usage);
153
154 if (lim > 0 && atomic64_read(&usbfs_memory_usage) > lim) {
155 atomic64_sub(amount, &usbfs_memory_usage);
156 return -ENOMEM;
157 }
158
159 return 0;
160 }
161
162 /* Memory for a transfer is being deallocated */
usbfs_decrease_memory_usage(u64 amount)163 static void usbfs_decrease_memory_usage(u64 amount)
164 {
165 atomic64_sub(amount, &usbfs_memory_usage);
166 }
167
connected(struct usb_dev_state * ps)168 static int connected(struct usb_dev_state *ps)
169 {
170 return (!list_empty(&ps->list) &&
171 ps->dev->state != USB_STATE_NOTATTACHED);
172 }
173
dec_usb_memory_use_count(struct usb_memory * usbm,int * count)174 static void dec_usb_memory_use_count(struct usb_memory *usbm, int *count)
175 {
176 struct usb_dev_state *ps = usbm->ps;
177 struct usb_hcd *hcd = bus_to_hcd(ps->dev->bus);
178 unsigned long flags;
179
180 spin_lock_irqsave(&ps->lock, flags);
181 --*count;
182 if (usbm->urb_use_count == 0 && usbm->vma_use_count == 0) {
183 list_del(&usbm->memlist);
184 spin_unlock_irqrestore(&ps->lock, flags);
185
186 hcd_buffer_free_pages(hcd, usbm->size,
187 usbm->mem, usbm->dma_handle);
188 usbfs_decrease_memory_usage(
189 usbm->size + sizeof(struct usb_memory));
190 kfree(usbm);
191 } else {
192 spin_unlock_irqrestore(&ps->lock, flags);
193 }
194 }
195
usbdev_vm_open(struct vm_area_struct * vma)196 static void usbdev_vm_open(struct vm_area_struct *vma)
197 {
198 struct usb_memory *usbm = vma->vm_private_data;
199 unsigned long flags;
200
201 spin_lock_irqsave(&usbm->ps->lock, flags);
202 ++usbm->vma_use_count;
203 spin_unlock_irqrestore(&usbm->ps->lock, flags);
204 }
205
usbdev_vm_close(struct vm_area_struct * vma)206 static void usbdev_vm_close(struct vm_area_struct *vma)
207 {
208 struct usb_memory *usbm = vma->vm_private_data;
209
210 dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
211 }
212
213 static const struct vm_operations_struct usbdev_vm_ops = {
214 .open = usbdev_vm_open,
215 .close = usbdev_vm_close
216 };
217
usbdev_mmap(struct file * file,struct vm_area_struct * vma)218 static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
219 {
220 struct usb_memory *usbm = NULL;
221 struct usb_dev_state *ps = file->private_data;
222 struct usb_hcd *hcd = bus_to_hcd(ps->dev->bus);
223 size_t size = vma->vm_end - vma->vm_start;
224 void *mem;
225 unsigned long flags;
226 dma_addr_t dma_handle = DMA_MAPPING_ERROR;
227 int ret;
228
229 ret = usbfs_increase_memory_usage(size + sizeof(struct usb_memory));
230 if (ret)
231 goto error;
232
233 usbm = kzalloc(sizeof(struct usb_memory), GFP_KERNEL);
234 if (!usbm) {
235 ret = -ENOMEM;
236 goto error_decrease_mem;
237 }
238
239 mem = hcd_buffer_alloc_pages(hcd,
240 size, GFP_USER | __GFP_NOWARN, &dma_handle);
241 if (!mem) {
242 ret = -ENOMEM;
243 goto error_free_usbm;
244 }
245
246 memset(mem, 0, size);
247
248 usbm->mem = mem;
249 usbm->dma_handle = dma_handle;
250 usbm->size = size;
251 usbm->ps = ps;
252 usbm->vm_start = vma->vm_start;
253 usbm->vma_use_count = 1;
254 INIT_LIST_HEAD(&usbm->memlist);
255
256 /*
257 * In DMA-unavailable cases, hcd_buffer_alloc_pages allocates
258 * normal pages and assigns DMA_MAPPING_ERROR to dma_handle. Check
259 * whether we are in such cases, and then use remap_pfn_range (or
260 * dma_mmap_coherent) to map normal (or DMA) pages into the user
261 * space, respectively.
262 */
263 if (dma_handle == DMA_MAPPING_ERROR) {
264 if (remap_pfn_range(vma, vma->vm_start,
265 virt_to_phys(usbm->mem) >> PAGE_SHIFT,
266 size, vma->vm_page_prot) < 0) {
267 dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
268 return -EAGAIN;
269 }
270 } else {
271 if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle,
272 size)) {
273 dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
274 return -EAGAIN;
275 }
276 }
277
278 vma->vm_flags |= VM_IO;
279 vma->vm_flags |= (VM_DONTEXPAND | VM_DONTDUMP);
280 vma->vm_ops = &usbdev_vm_ops;
281 vma->vm_private_data = usbm;
282
283 spin_lock_irqsave(&ps->lock, flags);
284 list_add_tail(&usbm->memlist, &ps->memory_list);
285 spin_unlock_irqrestore(&ps->lock, flags);
286
287 return 0;
288
289 error_free_usbm:
290 kfree(usbm);
291 error_decrease_mem:
292 usbfs_decrease_memory_usage(size + sizeof(struct usb_memory));
293 error:
294 return ret;
295 }
296
usbdev_read(struct file * file,char __user * buf,size_t nbytes,loff_t * ppos)297 static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
298 loff_t *ppos)
299 {
300 struct usb_dev_state *ps = file->private_data;
301 struct usb_device *dev = ps->dev;
302 ssize_t ret = 0;
303 unsigned len;
304 loff_t pos;
305 int i;
306
307 pos = *ppos;
308 usb_lock_device(dev);
309 if (!connected(ps)) {
310 ret = -ENODEV;
311 goto err;
312 } else if (pos < 0) {
313 ret = -EINVAL;
314 goto err;
315 }
316
317 if (pos < sizeof(struct usb_device_descriptor)) {
318 /* 18 bytes - fits on the stack */
319 struct usb_device_descriptor temp_desc;
320
321 memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
322 le16_to_cpus(&temp_desc.bcdUSB);
323 le16_to_cpus(&temp_desc.idVendor);
324 le16_to_cpus(&temp_desc.idProduct);
325 le16_to_cpus(&temp_desc.bcdDevice);
326
327 len = sizeof(struct usb_device_descriptor) - pos;
328 if (len > nbytes)
329 len = nbytes;
330 if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
331 ret = -EFAULT;
332 goto err;
333 }
334
335 *ppos += len;
336 buf += len;
337 nbytes -= len;
338 ret += len;
339 }
340
341 pos = sizeof(struct usb_device_descriptor);
342 for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
343 struct usb_config_descriptor *config =
344 (struct usb_config_descriptor *)dev->rawdescriptors[i];
345 unsigned int length = le16_to_cpu(config->wTotalLength);
346
347 if (*ppos < pos + length) {
348
349 /* The descriptor may claim to be longer than it
350 * really is. Here is the actual allocated length. */
351 unsigned alloclen =
352 le16_to_cpu(dev->config[i].desc.wTotalLength);
353
354 len = length - (*ppos - pos);
355 if (len > nbytes)
356 len = nbytes;
357
358 /* Simply don't write (skip over) unallocated parts */
359 if (alloclen > (*ppos - pos)) {
360 alloclen -= (*ppos - pos);
361 if (copy_to_user(buf,
362 dev->rawdescriptors[i] + (*ppos - pos),
363 min(len, alloclen))) {
364 ret = -EFAULT;
365 goto err;
366 }
367 }
368
369 *ppos += len;
370 buf += len;
371 nbytes -= len;
372 ret += len;
373 }
374
375 pos += length;
376 }
377
378 err:
379 usb_unlock_device(dev);
380 return ret;
381 }
382
383 /*
384 * async list handling
385 */
386
alloc_async(unsigned int numisoframes)387 static struct async *alloc_async(unsigned int numisoframes)
388 {
389 struct async *as;
390
391 as = kzalloc(sizeof(struct async), GFP_KERNEL);
392 if (!as)
393 return NULL;
394 as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
395 if (!as->urb) {
396 kfree(as);
397 return NULL;
398 }
399 return as;
400 }
401
free_async(struct async * as)402 static void free_async(struct async *as)
403 {
404 int i;
405
406 put_pid(as->pid);
407 if (as->cred)
408 put_cred(as->cred);
409 for (i = 0; i < as->urb->num_sgs; i++) {
410 if (sg_page(&as->urb->sg[i]))
411 kfree(sg_virt(&as->urb->sg[i]));
412 }
413
414 kfree(as->urb->sg);
415 if (as->usbm == NULL)
416 kfree(as->urb->transfer_buffer);
417 else
418 dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
419
420 kfree(as->urb->setup_packet);
421 usb_free_urb(as->urb);
422 usbfs_decrease_memory_usage(as->mem_usage);
423 kfree(as);
424 }
425
async_newpending(struct async * as)426 static void async_newpending(struct async *as)
427 {
428 struct usb_dev_state *ps = as->ps;
429 unsigned long flags;
430
431 spin_lock_irqsave(&ps->lock, flags);
432 list_add_tail(&as->asynclist, &ps->async_pending);
433 spin_unlock_irqrestore(&ps->lock, flags);
434 }
435
async_removepending(struct async * as)436 static void async_removepending(struct async *as)
437 {
438 struct usb_dev_state *ps = as->ps;
439 unsigned long flags;
440
441 spin_lock_irqsave(&ps->lock, flags);
442 list_del_init(&as->asynclist);
443 spin_unlock_irqrestore(&ps->lock, flags);
444 }
445
async_getcompleted(struct usb_dev_state * ps)446 static struct async *async_getcompleted(struct usb_dev_state *ps)
447 {
448 unsigned long flags;
449 struct async *as = NULL;
450
451 spin_lock_irqsave(&ps->lock, flags);
452 if (!list_empty(&ps->async_completed)) {
453 as = list_entry(ps->async_completed.next, struct async,
454 asynclist);
455 list_del_init(&as->asynclist);
456 }
457 spin_unlock_irqrestore(&ps->lock, flags);
458 return as;
459 }
460
async_getpending(struct usb_dev_state * ps,void __user * userurb)461 static struct async *async_getpending(struct usb_dev_state *ps,
462 void __user *userurb)
463 {
464 struct async *as;
465
466 list_for_each_entry(as, &ps->async_pending, asynclist)
467 if (as->userurb == userurb) {
468 list_del_init(&as->asynclist);
469 return as;
470 }
471
472 return NULL;
473 }
474
snoop_urb(struct usb_device * udev,void __user * userurb,int pipe,unsigned length,int timeout_or_status,enum snoop_when when,unsigned char * data,unsigned data_len)475 static void snoop_urb(struct usb_device *udev,
476 void __user *userurb, int pipe, unsigned length,
477 int timeout_or_status, enum snoop_when when,
478 unsigned char *data, unsigned data_len)
479 {
480 static const char *types[] = {"isoc", "int", "ctrl", "bulk"};
481 static const char *dirs[] = {"out", "in"};
482 int ep;
483 const char *t, *d;
484
485 if (!usbfs_snoop)
486 return;
487
488 ep = usb_pipeendpoint(pipe);
489 t = types[usb_pipetype(pipe)];
490 d = dirs[!!usb_pipein(pipe)];
491
492 if (userurb) { /* Async */
493 if (when == SUBMIT)
494 dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
495 "length %u\n",
496 userurb, ep, t, d, length);
497 else
498 dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
499 "actual_length %u status %d\n",
500 userurb, ep, t, d, length,
501 timeout_or_status);
502 } else {
503 if (when == SUBMIT)
504 dev_info(&udev->dev, "ep%d %s-%s, length %u, "
505 "timeout %d\n",
506 ep, t, d, length, timeout_or_status);
507 else
508 dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "
509 "status %d\n",
510 ep, t, d, length, timeout_or_status);
511 }
512
513 data_len = min(data_len, usbfs_snoop_max);
514 if (data && data_len > 0) {
515 print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
516 data, data_len, 1);
517 }
518 }
519
snoop_urb_data(struct urb * urb,unsigned len)520 static void snoop_urb_data(struct urb *urb, unsigned len)
521 {
522 int i, size;
523
524 len = min(len, usbfs_snoop_max);
525 if (!usbfs_snoop || len == 0)
526 return;
527
528 if (urb->num_sgs == 0) {
529 print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
530 urb->transfer_buffer, len, 1);
531 return;
532 }
533
534 for (i = 0; i < urb->num_sgs && len; i++) {
535 size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
536 print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
537 sg_virt(&urb->sg[i]), size, 1);
538 len -= size;
539 }
540 }
541
copy_urb_data_to_user(u8 __user * userbuffer,struct urb * urb)542 static int copy_urb_data_to_user(u8 __user *userbuffer, struct urb *urb)
543 {
544 unsigned i, len, size;
545
546 if (urb->number_of_packets > 0) /* Isochronous */
547 len = urb->transfer_buffer_length;
548 else /* Non-Isoc */
549 len = urb->actual_length;
550
551 if (urb->num_sgs == 0) {
552 if (copy_to_user(userbuffer, urb->transfer_buffer, len))
553 return -EFAULT;
554 return 0;
555 }
556
557 for (i = 0; i < urb->num_sgs && len; i++) {
558 size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
559 if (copy_to_user(userbuffer, sg_virt(&urb->sg[i]), size))
560 return -EFAULT;
561 userbuffer += size;
562 len -= size;
563 }
564
565 return 0;
566 }
567
568 #define AS_CONTINUATION 1
569 #define AS_UNLINK 2
570
cancel_bulk_urbs(struct usb_dev_state * ps,unsigned bulk_addr)571 static void cancel_bulk_urbs(struct usb_dev_state *ps, unsigned bulk_addr)
572 __releases(ps->lock)
573 __acquires(ps->lock)
574 {
575 struct urb *urb;
576 struct async *as;
577
578 /* Mark all the pending URBs that match bulk_addr, up to but not
579 * including the first one without AS_CONTINUATION. If such an
580 * URB is encountered then a new transfer has already started so
581 * the endpoint doesn't need to be disabled; otherwise it does.
582 */
583 list_for_each_entry(as, &ps->async_pending, asynclist) {
584 if (as->bulk_addr == bulk_addr) {
585 if (as->bulk_status != AS_CONTINUATION)
586 goto rescan;
587 as->bulk_status = AS_UNLINK;
588 as->bulk_addr = 0;
589 }
590 }
591 ps->disabled_bulk_eps |= (1 << bulk_addr);
592
593 /* Now carefully unlink all the marked pending URBs */
594 rescan:
595 list_for_each_entry_reverse(as, &ps->async_pending, asynclist) {
596 if (as->bulk_status == AS_UNLINK) {
597 as->bulk_status = 0; /* Only once */
598 urb = as->urb;
599 usb_get_urb(urb);
600 spin_unlock(&ps->lock); /* Allow completions */
601 usb_unlink_urb(urb);
602 usb_put_urb(urb);
603 spin_lock(&ps->lock);
604 goto rescan;
605 }
606 }
607 }
608
async_completed(struct urb * urb)609 static void async_completed(struct urb *urb)
610 {
611 struct async *as = urb->context;
612 struct usb_dev_state *ps = as->ps;
613 struct pid *pid = NULL;
614 const struct cred *cred = NULL;
615 unsigned long flags;
616 sigval_t addr;
617 int signr, errno;
618
619 spin_lock_irqsave(&ps->lock, flags);
620 list_move_tail(&as->asynclist, &ps->async_completed);
621 as->status = urb->status;
622 signr = as->signr;
623 if (signr) {
624 errno = as->status;
625 addr = as->userurb_sigval;
626 pid = get_pid(as->pid);
627 cred = get_cred(as->cred);
628 }
629 snoop(&urb->dev->dev, "urb complete\n");
630 snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
631 as->status, COMPLETE, NULL, 0);
632 if (usb_urb_dir_in(urb))
633 snoop_urb_data(urb, urb->actual_length);
634
635 if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
636 as->status != -ENOENT)
637 cancel_bulk_urbs(ps, as->bulk_addr);
638
639 wake_up(&ps->wait);
640 spin_unlock_irqrestore(&ps->lock, flags);
641
642 if (signr) {
643 kill_pid_usb_asyncio(signr, errno, addr, pid, cred);
644 put_pid(pid);
645 put_cred(cred);
646 }
647 }
648
destroy_async(struct usb_dev_state * ps,struct list_head * list)649 static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
650 {
651 struct urb *urb;
652 struct async *as;
653 unsigned long flags;
654
655 spin_lock_irqsave(&ps->lock, flags);
656 while (!list_empty(list)) {
657 as = list_last_entry(list, struct async, asynclist);
658 list_del_init(&as->asynclist);
659 urb = as->urb;
660 usb_get_urb(urb);
661
662 /* drop the spinlock so the completion handler can run */
663 spin_unlock_irqrestore(&ps->lock, flags);
664 usb_kill_urb(urb);
665 usb_put_urb(urb);
666 spin_lock_irqsave(&ps->lock, flags);
667 }
668 spin_unlock_irqrestore(&ps->lock, flags);
669 }
670
destroy_async_on_interface(struct usb_dev_state * ps,unsigned int ifnum)671 static void destroy_async_on_interface(struct usb_dev_state *ps,
672 unsigned int ifnum)
673 {
674 struct list_head *p, *q, hitlist;
675 unsigned long flags;
676
677 INIT_LIST_HEAD(&hitlist);
678 spin_lock_irqsave(&ps->lock, flags);
679 list_for_each_safe(p, q, &ps->async_pending)
680 if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
681 list_move_tail(p, &hitlist);
682 spin_unlock_irqrestore(&ps->lock, flags);
683 destroy_async(ps, &hitlist);
684 }
685
destroy_all_async(struct usb_dev_state * ps)686 static void destroy_all_async(struct usb_dev_state *ps)
687 {
688 destroy_async(ps, &ps->async_pending);
689 }
690
691 /*
692 * interface claims are made only at the request of user level code,
693 * which can also release them (explicitly or by closing files).
694 * they're also undone when devices disconnect.
695 */
696
driver_probe(struct usb_interface * intf,const struct usb_device_id * id)697 static int driver_probe(struct usb_interface *intf,
698 const struct usb_device_id *id)
699 {
700 return -ENODEV;
701 }
702
driver_disconnect(struct usb_interface * intf)703 static void driver_disconnect(struct usb_interface *intf)
704 {
705 struct usb_dev_state *ps = usb_get_intfdata(intf);
706 unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
707
708 if (!ps)
709 return;
710
711 /* NOTE: this relies on usbcore having canceled and completed
712 * all pending I/O requests; 2.6 does that.
713 */
714
715 if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
716 clear_bit(ifnum, &ps->ifclaimed);
717 else
718 dev_warn(&intf->dev, "interface number %u out of range\n",
719 ifnum);
720
721 usb_set_intfdata(intf, NULL);
722
723 /* force async requests to complete */
724 destroy_async_on_interface(ps, ifnum);
725 }
726
727 /* We don't care about suspend/resume of claimed interfaces */
driver_suspend(struct usb_interface * intf,pm_message_t msg)728 static int driver_suspend(struct usb_interface *intf, pm_message_t msg)
729 {
730 return 0;
731 }
732
driver_resume(struct usb_interface * intf)733 static int driver_resume(struct usb_interface *intf)
734 {
735 return 0;
736 }
737
738 #ifdef CONFIG_PM
739 /* The following routines apply to the entire device, not interfaces */
usbfs_notify_suspend(struct usb_device * udev)740 void usbfs_notify_suspend(struct usb_device *udev)
741 {
742 /* We don't need to handle this */
743 }
744
usbfs_notify_resume(struct usb_device * udev)745 void usbfs_notify_resume(struct usb_device *udev)
746 {
747 struct usb_dev_state *ps;
748
749 /* Protect against simultaneous remove or release */
750 mutex_lock(&usbfs_mutex);
751 list_for_each_entry(ps, &udev->filelist, list) {
752 WRITE_ONCE(ps->not_yet_resumed, 0);
753 wake_up_all(&ps->wait_for_resume);
754 }
755 mutex_unlock(&usbfs_mutex);
756 }
757 #endif
758
759 struct usb_driver usbfs_driver = {
760 .name = "usbfs",
761 .probe = driver_probe,
762 .disconnect = driver_disconnect,
763 .suspend = driver_suspend,
764 .resume = driver_resume,
765 .supports_autosuspend = 1,
766 };
767
claimintf(struct usb_dev_state * ps,unsigned int ifnum)768 static int claimintf(struct usb_dev_state *ps, unsigned int ifnum)
769 {
770 struct usb_device *dev = ps->dev;
771 struct usb_interface *intf;
772 int err;
773
774 if (ifnum >= 8*sizeof(ps->ifclaimed))
775 return -EINVAL;
776 /* already claimed */
777 if (test_bit(ifnum, &ps->ifclaimed))
778 return 0;
779
780 if (ps->privileges_dropped &&
781 !test_bit(ifnum, &ps->interface_allowed_mask))
782 return -EACCES;
783
784 intf = usb_ifnum_to_if(dev, ifnum);
785 if (!intf)
786 err = -ENOENT;
787 else {
788 unsigned int old_suppress;
789
790 /* suppress uevents while claiming interface */
791 old_suppress = dev_get_uevent_suppress(&intf->dev);
792 dev_set_uevent_suppress(&intf->dev, 1);
793 err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
794 dev_set_uevent_suppress(&intf->dev, old_suppress);
795 }
796 if (err == 0)
797 set_bit(ifnum, &ps->ifclaimed);
798 return err;
799 }
800
releaseintf(struct usb_dev_state * ps,unsigned int ifnum)801 static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum)
802 {
803 struct usb_device *dev;
804 struct usb_interface *intf;
805 int err;
806
807 err = -EINVAL;
808 if (ifnum >= 8*sizeof(ps->ifclaimed))
809 return err;
810 dev = ps->dev;
811 intf = usb_ifnum_to_if(dev, ifnum);
812 if (!intf)
813 err = -ENOENT;
814 else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
815 unsigned int old_suppress;
816
817 /* suppress uevents while releasing interface */
818 old_suppress = dev_get_uevent_suppress(&intf->dev);
819 dev_set_uevent_suppress(&intf->dev, 1);
820 usb_driver_release_interface(&usbfs_driver, intf);
821 dev_set_uevent_suppress(&intf->dev, old_suppress);
822 err = 0;
823 }
824 return err;
825 }
826
checkintf(struct usb_dev_state * ps,unsigned int ifnum)827 static int checkintf(struct usb_dev_state *ps, unsigned int ifnum)
828 {
829 if (ps->dev->state != USB_STATE_CONFIGURED)
830 return -EHOSTUNREACH;
831 if (ifnum >= 8*sizeof(ps->ifclaimed))
832 return -EINVAL;
833 if (test_bit(ifnum, &ps->ifclaimed))
834 return 0;
835 /* if not yet claimed, claim it for the driver */
836 dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim "
837 "interface %u before use\n", task_pid_nr(current),
838 current->comm, ifnum);
839 return claimintf(ps, ifnum);
840 }
841
findintfep(struct usb_device * dev,unsigned int ep)842 static int findintfep(struct usb_device *dev, unsigned int ep)
843 {
844 unsigned int i, j, e;
845 struct usb_interface *intf;
846 struct usb_host_interface *alts;
847 struct usb_endpoint_descriptor *endpt;
848
849 if (ep & ~(USB_DIR_IN|0xf))
850 return -EINVAL;
851 if (!dev->actconfig)
852 return -ESRCH;
853 for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
854 intf = dev->actconfig->interface[i];
855 for (j = 0; j < intf->num_altsetting; j++) {
856 alts = &intf->altsetting[j];
857 for (e = 0; e < alts->desc.bNumEndpoints; e++) {
858 endpt = &alts->endpoint[e].desc;
859 if (endpt->bEndpointAddress == ep)
860 return alts->desc.bInterfaceNumber;
861 }
862 }
863 }
864 return -ENOENT;
865 }
866
check_ctrlrecip(struct usb_dev_state * ps,unsigned int requesttype,unsigned int request,unsigned int index)867 static int check_ctrlrecip(struct usb_dev_state *ps, unsigned int requesttype,
868 unsigned int request, unsigned int index)
869 {
870 int ret = 0;
871 struct usb_host_interface *alt_setting;
872
873 if (ps->dev->state != USB_STATE_UNAUTHENTICATED
874 && ps->dev->state != USB_STATE_ADDRESS
875 && ps->dev->state != USB_STATE_CONFIGURED)
876 return -EHOSTUNREACH;
877 if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
878 return 0;
879
880 /*
881 * check for the special corner case 'get_device_id' in the printer
882 * class specification, which we always want to allow as it is used
883 * to query things like ink level, etc.
884 */
885 if (requesttype == 0xa1 && request == 0) {
886 alt_setting = usb_find_alt_setting(ps->dev->actconfig,
887 index >> 8, index & 0xff);
888 if (alt_setting
889 && alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
890 return 0;
891 }
892
893 index &= 0xff;
894 switch (requesttype & USB_RECIP_MASK) {
895 case USB_RECIP_ENDPOINT:
896 if ((index & ~USB_DIR_IN) == 0)
897 return 0;
898 ret = findintfep(ps->dev, index);
899 if (ret < 0) {
900 /*
901 * Some not fully compliant Win apps seem to get
902 * index wrong and have the endpoint number here
903 * rather than the endpoint address (with the
904 * correct direction). Win does let this through,
905 * so we'll not reject it here but leave it to
906 * the device to not break KVM. But we warn.
907 */
908 ret = findintfep(ps->dev, index ^ 0x80);
909 if (ret >= 0)
910 dev_info(&ps->dev->dev,
911 "%s: process %i (%s) requesting ep %02x but needs %02x\n",
912 __func__, task_pid_nr(current),
913 current->comm, index, index ^ 0x80);
914 }
915 if (ret >= 0)
916 ret = checkintf(ps, ret);
917 break;
918
919 case USB_RECIP_INTERFACE:
920 ret = checkintf(ps, index);
921 break;
922 }
923 return ret;
924 }
925
ep_to_host_endpoint(struct usb_device * dev,unsigned char ep)926 static struct usb_host_endpoint *ep_to_host_endpoint(struct usb_device *dev,
927 unsigned char ep)
928 {
929 if (ep & USB_ENDPOINT_DIR_MASK)
930 return dev->ep_in[ep & USB_ENDPOINT_NUMBER_MASK];
931 else
932 return dev->ep_out[ep & USB_ENDPOINT_NUMBER_MASK];
933 }
934
parse_usbdevfs_streams(struct usb_dev_state * ps,struct usbdevfs_streams __user * streams,unsigned int * num_streams_ret,unsigned int * num_eps_ret,struct usb_host_endpoint *** eps_ret,struct usb_interface ** intf_ret)935 static int parse_usbdevfs_streams(struct usb_dev_state *ps,
936 struct usbdevfs_streams __user *streams,
937 unsigned int *num_streams_ret,
938 unsigned int *num_eps_ret,
939 struct usb_host_endpoint ***eps_ret,
940 struct usb_interface **intf_ret)
941 {
942 unsigned int i, num_streams, num_eps;
943 struct usb_host_endpoint **eps;
944 struct usb_interface *intf = NULL;
945 unsigned char ep;
946 int ifnum, ret;
947
948 if (get_user(num_streams, &streams->num_streams) ||
949 get_user(num_eps, &streams->num_eps))
950 return -EFAULT;
951
952 if (num_eps < 1 || num_eps > USB_MAXENDPOINTS)
953 return -EINVAL;
954
955 /* The XHCI controller allows max 2 ^ 16 streams */
956 if (num_streams_ret && (num_streams < 2 || num_streams > 65536))
957 return -EINVAL;
958
959 eps = kmalloc_array(num_eps, sizeof(*eps), GFP_KERNEL);
960 if (!eps)
961 return -ENOMEM;
962
963 for (i = 0; i < num_eps; i++) {
964 if (get_user(ep, &streams->eps[i])) {
965 ret = -EFAULT;
966 goto error;
967 }
968 eps[i] = ep_to_host_endpoint(ps->dev, ep);
969 if (!eps[i]) {
970 ret = -EINVAL;
971 goto error;
972 }
973
974 /* usb_alloc/free_streams operate on an usb_interface */
975 ifnum = findintfep(ps->dev, ep);
976 if (ifnum < 0) {
977 ret = ifnum;
978 goto error;
979 }
980
981 if (i == 0) {
982 ret = checkintf(ps, ifnum);
983 if (ret < 0)
984 goto error;
985 intf = usb_ifnum_to_if(ps->dev, ifnum);
986 } else {
987 /* Verify all eps belong to the same interface */
988 if (ifnum != intf->altsetting->desc.bInterfaceNumber) {
989 ret = -EINVAL;
990 goto error;
991 }
992 }
993 }
994
995 if (num_streams_ret)
996 *num_streams_ret = num_streams;
997 *num_eps_ret = num_eps;
998 *eps_ret = eps;
999 *intf_ret = intf;
1000
1001 return 0;
1002
1003 error:
1004 kfree(eps);
1005 return ret;
1006 }
1007
usbdev_lookup_by_devt(dev_t devt)1008 static struct usb_device *usbdev_lookup_by_devt(dev_t devt)
1009 {
1010 struct device *dev;
1011
1012 dev = bus_find_device_by_devt(&usb_bus_type, devt);
1013 if (!dev)
1014 return NULL;
1015 return to_usb_device(dev);
1016 }
1017
1018 /*
1019 * file operations
1020 */
usbdev_open(struct inode * inode,struct file * file)1021 static int usbdev_open(struct inode *inode, struct file *file)
1022 {
1023 struct usb_device *dev = NULL;
1024 struct usb_dev_state *ps;
1025 int ret;
1026
1027 ret = -ENOMEM;
1028 ps = kzalloc(sizeof(struct usb_dev_state), GFP_KERNEL);
1029 if (!ps)
1030 goto out_free_ps;
1031
1032 ret = -ENODEV;
1033
1034 /* usbdev device-node */
1035 if (imajor(inode) == USB_DEVICE_MAJOR)
1036 dev = usbdev_lookup_by_devt(inode->i_rdev);
1037 if (!dev)
1038 goto out_free_ps;
1039
1040 usb_lock_device(dev);
1041 if (dev->state == USB_STATE_NOTATTACHED)
1042 goto out_unlock_device;
1043
1044 ret = usb_autoresume_device(dev);
1045 if (ret)
1046 goto out_unlock_device;
1047
1048 ps->dev = dev;
1049 ps->file = file;
1050 ps->interface_allowed_mask = 0xFFFFFFFF; /* 32 bits */
1051 spin_lock_init(&ps->lock);
1052 INIT_LIST_HEAD(&ps->list);
1053 INIT_LIST_HEAD(&ps->async_pending);
1054 INIT_LIST_HEAD(&ps->async_completed);
1055 INIT_LIST_HEAD(&ps->memory_list);
1056 init_waitqueue_head(&ps->wait);
1057 init_waitqueue_head(&ps->wait_for_resume);
1058 ps->disc_pid = get_pid(task_pid(current));
1059 ps->cred = get_current_cred();
1060 smp_wmb();
1061
1062 /* Can't race with resume; the device is already active */
1063 list_add_tail(&ps->list, &dev->filelist);
1064 file->private_data = ps;
1065 usb_unlock_device(dev);
1066 snoop(&dev->dev, "opened by process %d: %s\n", task_pid_nr(current),
1067 current->comm);
1068 return ret;
1069
1070 out_unlock_device:
1071 usb_unlock_device(dev);
1072 usb_put_dev(dev);
1073 out_free_ps:
1074 kfree(ps);
1075 return ret;
1076 }
1077
usbdev_release(struct inode * inode,struct file * file)1078 static int usbdev_release(struct inode *inode, struct file *file)
1079 {
1080 struct usb_dev_state *ps = file->private_data;
1081 struct usb_device *dev = ps->dev;
1082 unsigned int ifnum;
1083 struct async *as;
1084
1085 usb_lock_device(dev);
1086 usb_hub_release_all_ports(dev, ps);
1087
1088 /* Protect against simultaneous resume */
1089 mutex_lock(&usbfs_mutex);
1090 list_del_init(&ps->list);
1091 mutex_unlock(&usbfs_mutex);
1092
1093 for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
1094 ifnum++) {
1095 if (test_bit(ifnum, &ps->ifclaimed))
1096 releaseintf(ps, ifnum);
1097 }
1098 destroy_all_async(ps);
1099 if (!ps->suspend_allowed)
1100 usb_autosuspend_device(dev);
1101 usb_unlock_device(dev);
1102 usb_put_dev(dev);
1103 put_pid(ps->disc_pid);
1104 put_cred(ps->cred);
1105
1106 as = async_getcompleted(ps);
1107 while (as) {
1108 free_async(as);
1109 as = async_getcompleted(ps);
1110 }
1111
1112 kfree(ps);
1113 return 0;
1114 }
1115
usbfs_blocking_completion(struct urb * urb)1116 static void usbfs_blocking_completion(struct urb *urb)
1117 {
1118 complete((struct completion *) urb->context);
1119 }
1120
1121 /*
1122 * Much like usb_start_wait_urb, but returns status separately from
1123 * actual_length and uses a killable wait.
1124 */
usbfs_start_wait_urb(struct urb * urb,int timeout,unsigned int * actlen)1125 static int usbfs_start_wait_urb(struct urb *urb, int timeout,
1126 unsigned int *actlen)
1127 {
1128 DECLARE_COMPLETION_ONSTACK(ctx);
1129 unsigned long expire;
1130 int rc;
1131
1132 urb->context = &ctx;
1133 urb->complete = usbfs_blocking_completion;
1134 *actlen = 0;
1135 rc = usb_submit_urb(urb, GFP_KERNEL);
1136 if (unlikely(rc))
1137 return rc;
1138
1139 expire = (timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT);
1140 rc = wait_for_completion_killable_timeout(&ctx, expire);
1141 if (rc <= 0) {
1142 usb_kill_urb(urb);
1143 *actlen = urb->actual_length;
1144 if (urb->status != -ENOENT)
1145 ; /* Completed before it was killed */
1146 else if (rc < 0)
1147 return -EINTR;
1148 else
1149 return -ETIMEDOUT;
1150 }
1151 *actlen = urb->actual_length;
1152 return urb->status;
1153 }
1154
do_proc_control(struct usb_dev_state * ps,struct usbdevfs_ctrltransfer * ctrl)1155 static int do_proc_control(struct usb_dev_state *ps,
1156 struct usbdevfs_ctrltransfer *ctrl)
1157 {
1158 struct usb_device *dev = ps->dev;
1159 unsigned int tmo;
1160 unsigned char *tbuf;
1161 unsigned int wLength, actlen;
1162 int i, pipe, ret;
1163 struct urb *urb = NULL;
1164 struct usb_ctrlrequest *dr = NULL;
1165
1166 ret = check_ctrlrecip(ps, ctrl->bRequestType, ctrl->bRequest,
1167 ctrl->wIndex);
1168 if (ret)
1169 return ret;
1170 wLength = ctrl->wLength; /* To suppress 64k PAGE_SIZE warning */
1171 if (wLength > PAGE_SIZE)
1172 return -EINVAL;
1173 ret = usbfs_increase_memory_usage(PAGE_SIZE + sizeof(struct urb) +
1174 sizeof(struct usb_ctrlrequest));
1175 if (ret)
1176 return ret;
1177
1178 ret = -ENOMEM;
1179 tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
1180 if (!tbuf)
1181 goto done;
1182 urb = usb_alloc_urb(0, GFP_NOIO);
1183 if (!urb)
1184 goto done;
1185 dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO);
1186 if (!dr)
1187 goto done;
1188
1189 dr->bRequestType = ctrl->bRequestType;
1190 dr->bRequest = ctrl->bRequest;
1191 dr->wValue = cpu_to_le16(ctrl->wValue);
1192 dr->wIndex = cpu_to_le16(ctrl->wIndex);
1193 dr->wLength = cpu_to_le16(ctrl->wLength);
1194
1195 tmo = ctrl->timeout;
1196 snoop(&dev->dev, "control urb: bRequestType=%02x "
1197 "bRequest=%02x wValue=%04x "
1198 "wIndex=%04x wLength=%04x\n",
1199 ctrl->bRequestType, ctrl->bRequest, ctrl->wValue,
1200 ctrl->wIndex, ctrl->wLength);
1201
1202 if ((ctrl->bRequestType & USB_DIR_IN) && wLength) {
1203 pipe = usb_rcvctrlpipe(dev, 0);
1204 usb_fill_control_urb(urb, dev, pipe, (unsigned char *) dr, tbuf,
1205 wLength, NULL, NULL);
1206 snoop_urb(dev, NULL, pipe, wLength, tmo, SUBMIT, NULL, 0);
1207
1208 usb_unlock_device(dev);
1209 i = usbfs_start_wait_urb(urb, tmo, &actlen);
1210
1211 /* Linger a bit, prior to the next control message. */
1212 if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
1213 msleep(200);
1214 usb_lock_device(dev);
1215 snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, tbuf, actlen);
1216 if (!i && actlen) {
1217 if (copy_to_user(ctrl->data, tbuf, actlen)) {
1218 ret = -EFAULT;
1219 goto done;
1220 }
1221 }
1222 } else {
1223 if (wLength) {
1224 if (copy_from_user(tbuf, ctrl->data, wLength)) {
1225 ret = -EFAULT;
1226 goto done;
1227 }
1228 }
1229 pipe = usb_sndctrlpipe(dev, 0);
1230 usb_fill_control_urb(urb, dev, pipe, (unsigned char *) dr, tbuf,
1231 wLength, NULL, NULL);
1232 snoop_urb(dev, NULL, pipe, wLength, tmo, SUBMIT, tbuf, wLength);
1233
1234 usb_unlock_device(dev);
1235 i = usbfs_start_wait_urb(urb, tmo, &actlen);
1236
1237 /* Linger a bit, prior to the next control message. */
1238 if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
1239 msleep(200);
1240 usb_lock_device(dev);
1241 snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, NULL, 0);
1242 }
1243 if (i < 0 && i != -EPIPE) {
1244 dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
1245 "failed cmd %s rqt %u rq %u len %u ret %d\n",
1246 current->comm, ctrl->bRequestType, ctrl->bRequest,
1247 ctrl->wLength, i);
1248 }
1249 ret = (i < 0 ? i : actlen);
1250
1251 done:
1252 kfree(dr);
1253 usb_free_urb(urb);
1254 free_page((unsigned long) tbuf);
1255 usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +
1256 sizeof(struct usb_ctrlrequest));
1257 return ret;
1258 }
1259
proc_control(struct usb_dev_state * ps,void __user * arg)1260 static int proc_control(struct usb_dev_state *ps, void __user *arg)
1261 {
1262 struct usbdevfs_ctrltransfer ctrl;
1263
1264 if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
1265 return -EFAULT;
1266 return do_proc_control(ps, &ctrl);
1267 }
1268
do_proc_bulk(struct usb_dev_state * ps,struct usbdevfs_bulktransfer * bulk)1269 static int do_proc_bulk(struct usb_dev_state *ps,
1270 struct usbdevfs_bulktransfer *bulk)
1271 {
1272 struct usb_device *dev = ps->dev;
1273 unsigned int tmo, len1, len2, pipe;
1274 unsigned char *tbuf;
1275 int i, ret;
1276 struct urb *urb = NULL;
1277 struct usb_host_endpoint *ep;
1278
1279 ret = findintfep(ps->dev, bulk->ep);
1280 if (ret < 0)
1281 return ret;
1282 ret = checkintf(ps, ret);
1283 if (ret)
1284 return ret;
1285
1286 len1 = bulk->len;
1287 if (len1 < 0 || len1 >= (INT_MAX - sizeof(struct urb)))
1288 return -EINVAL;
1289
1290 if (bulk->ep & USB_DIR_IN)
1291 pipe = usb_rcvbulkpipe(dev, bulk->ep & 0x7f);
1292 else
1293 pipe = usb_sndbulkpipe(dev, bulk->ep & 0x7f);
1294 ep = usb_pipe_endpoint(dev, pipe);
1295 if (!ep || !usb_endpoint_maxp(&ep->desc))
1296 return -EINVAL;
1297 ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));
1298 if (ret)
1299 return ret;
1300
1301 /*
1302 * len1 can be almost arbitrarily large. Don't WARN if it's
1303 * too big, just fail the request.
1304 */
1305 ret = -ENOMEM;
1306 tbuf = kmalloc(len1, GFP_KERNEL | __GFP_NOWARN);
1307 if (!tbuf)
1308 goto done;
1309 urb = usb_alloc_urb(0, GFP_KERNEL);
1310 if (!urb)
1311 goto done;
1312
1313 if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
1314 USB_ENDPOINT_XFER_INT) {
1315 pipe = (pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
1316 usb_fill_int_urb(urb, dev, pipe, tbuf, len1,
1317 NULL, NULL, ep->desc.bInterval);
1318 } else {
1319 usb_fill_bulk_urb(urb, dev, pipe, tbuf, len1, NULL, NULL);
1320 }
1321
1322 tmo = bulk->timeout;
1323 if (bulk->ep & 0x80) {
1324 snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0);
1325
1326 usb_unlock_device(dev);
1327 i = usbfs_start_wait_urb(urb, tmo, &len2);
1328 usb_lock_device(dev);
1329 snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
1330
1331 if (!i && len2) {
1332 if (copy_to_user(bulk->data, tbuf, len2)) {
1333 ret = -EFAULT;
1334 goto done;
1335 }
1336 }
1337 } else {
1338 if (len1) {
1339 if (copy_from_user(tbuf, bulk->data, len1)) {
1340 ret = -EFAULT;
1341 goto done;
1342 }
1343 }
1344 snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, tbuf, len1);
1345
1346 usb_unlock_device(dev);
1347 i = usbfs_start_wait_urb(urb, tmo, &len2);
1348 usb_lock_device(dev);
1349 snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, NULL, 0);
1350 }
1351 ret = (i < 0 ? i : len2);
1352 done:
1353 usb_free_urb(urb);
1354 kfree(tbuf);
1355 usbfs_decrease_memory_usage(len1 + sizeof(struct urb));
1356 return ret;
1357 }
1358
proc_bulk(struct usb_dev_state * ps,void __user * arg)1359 static int proc_bulk(struct usb_dev_state *ps, void __user *arg)
1360 {
1361 struct usbdevfs_bulktransfer bulk;
1362
1363 if (copy_from_user(&bulk, arg, sizeof(bulk)))
1364 return -EFAULT;
1365 return do_proc_bulk(ps, &bulk);
1366 }
1367
check_reset_of_active_ep(struct usb_device * udev,unsigned int epnum,char * ioctl_name)1368 static void check_reset_of_active_ep(struct usb_device *udev,
1369 unsigned int epnum, char *ioctl_name)
1370 {
1371 struct usb_host_endpoint **eps;
1372 struct usb_host_endpoint *ep;
1373
1374 eps = (epnum & USB_DIR_IN) ? udev->ep_in : udev->ep_out;
1375 ep = eps[epnum & 0x0f];
1376 if (ep && !list_empty(&ep->urb_list))
1377 dev_warn(&udev->dev, "Process %d (%s) called USBDEVFS_%s for active endpoint 0x%02x\n",
1378 task_pid_nr(current), current->comm,
1379 ioctl_name, epnum);
1380 }
1381
proc_resetep(struct usb_dev_state * ps,void __user * arg)1382 static int proc_resetep(struct usb_dev_state *ps, void __user *arg)
1383 {
1384 unsigned int ep;
1385 int ret;
1386
1387 if (get_user(ep, (unsigned int __user *)arg))
1388 return -EFAULT;
1389 ret = findintfep(ps->dev, ep);
1390 if (ret < 0)
1391 return ret;
1392 ret = checkintf(ps, ret);
1393 if (ret)
1394 return ret;
1395 check_reset_of_active_ep(ps->dev, ep, "RESETEP");
1396 usb_reset_endpoint(ps->dev, ep);
1397 return 0;
1398 }
1399
proc_clearhalt(struct usb_dev_state * ps,void __user * arg)1400 static int proc_clearhalt(struct usb_dev_state *ps, void __user *arg)
1401 {
1402 unsigned int ep;
1403 int pipe;
1404 int ret;
1405
1406 if (get_user(ep, (unsigned int __user *)arg))
1407 return -EFAULT;
1408 ret = findintfep(ps->dev, ep);
1409 if (ret < 0)
1410 return ret;
1411 ret = checkintf(ps, ret);
1412 if (ret)
1413 return ret;
1414 check_reset_of_active_ep(ps->dev, ep, "CLEAR_HALT");
1415 if (ep & USB_DIR_IN)
1416 pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
1417 else
1418 pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
1419
1420 return usb_clear_halt(ps->dev, pipe);
1421 }
1422
proc_getdriver(struct usb_dev_state * ps,void __user * arg)1423 static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
1424 {
1425 struct usbdevfs_getdriver gd;
1426 struct usb_interface *intf;
1427 int ret;
1428
1429 if (copy_from_user(&gd, arg, sizeof(gd)))
1430 return -EFAULT;
1431 intf = usb_ifnum_to_if(ps->dev, gd.interface);
1432 if (!intf || !intf->dev.driver)
1433 ret = -ENODATA;
1434 else {
1435 strscpy(gd.driver, intf->dev.driver->name,
1436 sizeof(gd.driver));
1437 ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
1438 }
1439 return ret;
1440 }
1441
proc_connectinfo(struct usb_dev_state * ps,void __user * arg)1442 static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
1443 {
1444 struct usbdevfs_connectinfo ci;
1445
1446 memset(&ci, 0, sizeof(ci));
1447 ci.devnum = ps->dev->devnum;
1448 ci.slow = ps->dev->speed == USB_SPEED_LOW;
1449
1450 if (copy_to_user(arg, &ci, sizeof(ci)))
1451 return -EFAULT;
1452 return 0;
1453 }
1454
proc_conninfo_ex(struct usb_dev_state * ps,void __user * arg,size_t size)1455 static int proc_conninfo_ex(struct usb_dev_state *ps,
1456 void __user *arg, size_t size)
1457 {
1458 struct usbdevfs_conninfo_ex ci;
1459 struct usb_device *udev = ps->dev;
1460
1461 if (size < sizeof(ci.size))
1462 return -EINVAL;
1463
1464 memset(&ci, 0, sizeof(ci));
1465 ci.size = sizeof(ci);
1466 ci.busnum = udev->bus->busnum;
1467 ci.devnum = udev->devnum;
1468 ci.speed = udev->speed;
1469
1470 while (udev && udev->portnum != 0) {
1471 if (++ci.num_ports <= ARRAY_SIZE(ci.ports))
1472 ci.ports[ARRAY_SIZE(ci.ports) - ci.num_ports] =
1473 udev->portnum;
1474 udev = udev->parent;
1475 }
1476
1477 if (ci.num_ports < ARRAY_SIZE(ci.ports))
1478 memmove(&ci.ports[0],
1479 &ci.ports[ARRAY_SIZE(ci.ports) - ci.num_ports],
1480 ci.num_ports);
1481
1482 if (copy_to_user(arg, &ci, min(sizeof(ci), size)))
1483 return -EFAULT;
1484
1485 return 0;
1486 }
1487
proc_resetdevice(struct usb_dev_state * ps)1488 static int proc_resetdevice(struct usb_dev_state *ps)
1489 {
1490 struct usb_host_config *actconfig = ps->dev->actconfig;
1491 struct usb_interface *interface;
1492 int i, number;
1493
1494 /* Don't allow a device reset if the process has dropped the
1495 * privilege to do such things and any of the interfaces are
1496 * currently claimed.
1497 */
1498 if (ps->privileges_dropped && actconfig) {
1499 for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1500 interface = actconfig->interface[i];
1501 number = interface->cur_altsetting->desc.bInterfaceNumber;
1502 if (usb_interface_claimed(interface) &&
1503 !test_bit(number, &ps->ifclaimed)) {
1504 dev_warn(&ps->dev->dev,
1505 "usbfs: interface %d claimed by %s while '%s' resets device\n",
1506 number, interface->dev.driver->name, current->comm);
1507 return -EACCES;
1508 }
1509 }
1510 }
1511
1512 return usb_reset_device(ps->dev);
1513 }
1514
proc_setintf(struct usb_dev_state * ps,void __user * arg)1515 static int proc_setintf(struct usb_dev_state *ps, void __user *arg)
1516 {
1517 struct usbdevfs_setinterface setintf;
1518 int ret;
1519
1520 if (copy_from_user(&setintf, arg, sizeof(setintf)))
1521 return -EFAULT;
1522 ret = checkintf(ps, setintf.interface);
1523 if (ret)
1524 return ret;
1525
1526 destroy_async_on_interface(ps, setintf.interface);
1527
1528 return usb_set_interface(ps->dev, setintf.interface,
1529 setintf.altsetting);
1530 }
1531
proc_setconfig(struct usb_dev_state * ps,void __user * arg)1532 static int proc_setconfig(struct usb_dev_state *ps, void __user *arg)
1533 {
1534 int u;
1535 int status = 0;
1536 struct usb_host_config *actconfig;
1537
1538 if (get_user(u, (int __user *)arg))
1539 return -EFAULT;
1540
1541 actconfig = ps->dev->actconfig;
1542
1543 /* Don't touch the device if any interfaces are claimed.
1544 * It could interfere with other drivers' operations, and if
1545 * an interface is claimed by usbfs it could easily deadlock.
1546 */
1547 if (actconfig) {
1548 int i;
1549
1550 for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1551 if (usb_interface_claimed(actconfig->interface[i])) {
1552 dev_warn(&ps->dev->dev,
1553 "usbfs: interface %d claimed by %s "
1554 "while '%s' sets config #%d\n",
1555 actconfig->interface[i]
1556 ->cur_altsetting
1557 ->desc.bInterfaceNumber,
1558 actconfig->interface[i]
1559 ->dev.driver->name,
1560 current->comm, u);
1561 status = -EBUSY;
1562 break;
1563 }
1564 }
1565 }
1566
1567 /* SET_CONFIGURATION is often abused as a "cheap" driver reset,
1568 * so avoid usb_set_configuration()'s kick to sysfs
1569 */
1570 if (status == 0) {
1571 if (actconfig && actconfig->desc.bConfigurationValue == u)
1572 status = usb_reset_configuration(ps->dev);
1573 else
1574 status = usb_set_configuration(ps->dev, u);
1575 }
1576
1577 return status;
1578 }
1579
1580 static struct usb_memory *
find_memory_area(struct usb_dev_state * ps,const struct usbdevfs_urb * uurb)1581 find_memory_area(struct usb_dev_state *ps, const struct usbdevfs_urb *uurb)
1582 {
1583 struct usb_memory *usbm = NULL, *iter;
1584 unsigned long flags;
1585 unsigned long uurb_start = (unsigned long)uurb->buffer;
1586
1587 spin_lock_irqsave(&ps->lock, flags);
1588 list_for_each_entry(iter, &ps->memory_list, memlist) {
1589 if (uurb_start >= iter->vm_start &&
1590 uurb_start < iter->vm_start + iter->size) {
1591 if (uurb->buffer_length > iter->vm_start + iter->size -
1592 uurb_start) {
1593 usbm = ERR_PTR(-EINVAL);
1594 } else {
1595 usbm = iter;
1596 usbm->urb_use_count++;
1597 }
1598 break;
1599 }
1600 }
1601 spin_unlock_irqrestore(&ps->lock, flags);
1602 return usbm;
1603 }
1604
proc_do_submiturb(struct usb_dev_state * ps,struct usbdevfs_urb * uurb,struct usbdevfs_iso_packet_desc __user * iso_frame_desc,void __user * arg,sigval_t userurb_sigval)1605 static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb,
1606 struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
1607 void __user *arg, sigval_t userurb_sigval)
1608 {
1609 struct usbdevfs_iso_packet_desc *isopkt = NULL;
1610 struct usb_host_endpoint *ep;
1611 struct async *as = NULL;
1612 struct usb_ctrlrequest *dr = NULL;
1613 unsigned int u, totlen, isofrmlen;
1614 int i, ret, num_sgs = 0, ifnum = -1;
1615 int number_of_packets = 0;
1616 unsigned int stream_id = 0;
1617 void *buf;
1618 bool is_in;
1619 bool allow_short = false;
1620 bool allow_zero = false;
1621 unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK |
1622 USBDEVFS_URB_BULK_CONTINUATION |
1623 USBDEVFS_URB_NO_FSBR |
1624 USBDEVFS_URB_ZERO_PACKET |
1625 USBDEVFS_URB_NO_INTERRUPT;
1626 /* USBDEVFS_URB_ISO_ASAP is a special case */
1627 if (uurb->type == USBDEVFS_URB_TYPE_ISO)
1628 mask |= USBDEVFS_URB_ISO_ASAP;
1629
1630 if (uurb->flags & ~mask)
1631 return -EINVAL;
1632
1633 if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
1634 return -EINVAL;
1635 if (uurb->buffer_length > 0 && !uurb->buffer)
1636 return -EINVAL;
1637 if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
1638 (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
1639 ifnum = findintfep(ps->dev, uurb->endpoint);
1640 if (ifnum < 0)
1641 return ifnum;
1642 ret = checkintf(ps, ifnum);
1643 if (ret)
1644 return ret;
1645 }
1646 ep = ep_to_host_endpoint(ps->dev, uurb->endpoint);
1647 if (!ep)
1648 return -ENOENT;
1649 is_in = (uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0;
1650
1651 u = 0;
1652 switch (uurb->type) {
1653 case USBDEVFS_URB_TYPE_CONTROL:
1654 if (!usb_endpoint_xfer_control(&ep->desc))
1655 return -EINVAL;
1656 /* min 8 byte setup packet */
1657 if (uurb->buffer_length < 8)
1658 return -EINVAL;
1659 dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
1660 if (!dr)
1661 return -ENOMEM;
1662 if (copy_from_user(dr, uurb->buffer, 8)) {
1663 ret = -EFAULT;
1664 goto error;
1665 }
1666 if (uurb->buffer_length < (le16_to_cpu(dr->wLength) + 8)) {
1667 ret = -EINVAL;
1668 goto error;
1669 }
1670 ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
1671 le16_to_cpu(dr->wIndex));
1672 if (ret)
1673 goto error;
1674 uurb->buffer_length = le16_to_cpu(dr->wLength);
1675 uurb->buffer += 8;
1676 if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {
1677 is_in = true;
1678 uurb->endpoint |= USB_DIR_IN;
1679 } else {
1680 is_in = false;
1681 uurb->endpoint &= ~USB_DIR_IN;
1682 }
1683 if (is_in)
1684 allow_short = true;
1685 snoop(&ps->dev->dev, "control urb: bRequestType=%02x "
1686 "bRequest=%02x wValue=%04x "
1687 "wIndex=%04x wLength=%04x\n",
1688 dr->bRequestType, dr->bRequest,
1689 __le16_to_cpu(dr->wValue),
1690 __le16_to_cpu(dr->wIndex),
1691 __le16_to_cpu(dr->wLength));
1692 u = sizeof(struct usb_ctrlrequest);
1693 break;
1694
1695 case USBDEVFS_URB_TYPE_BULK:
1696 if (!is_in)
1697 allow_zero = true;
1698 else
1699 allow_short = true;
1700 switch (usb_endpoint_type(&ep->desc)) {
1701 case USB_ENDPOINT_XFER_CONTROL:
1702 case USB_ENDPOINT_XFER_ISOC:
1703 return -EINVAL;
1704 case USB_ENDPOINT_XFER_INT:
1705 /* allow single-shot interrupt transfers */
1706 uurb->type = USBDEVFS_URB_TYPE_INTERRUPT;
1707 goto interrupt_urb;
1708 }
1709 num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);
1710 if (num_sgs == 1 || num_sgs > ps->dev->bus->sg_tablesize)
1711 num_sgs = 0;
1712 if (ep->streams)
1713 stream_id = uurb->stream_id;
1714 break;
1715
1716 case USBDEVFS_URB_TYPE_INTERRUPT:
1717 if (!usb_endpoint_xfer_int(&ep->desc))
1718 return -EINVAL;
1719 interrupt_urb:
1720 if (!is_in)
1721 allow_zero = true;
1722 else
1723 allow_short = true;
1724 break;
1725
1726 case USBDEVFS_URB_TYPE_ISO:
1727 /* arbitrary limit */
1728 if (uurb->number_of_packets < 1 ||
1729 uurb->number_of_packets > 128)
1730 return -EINVAL;
1731 if (!usb_endpoint_xfer_isoc(&ep->desc))
1732 return -EINVAL;
1733 number_of_packets = uurb->number_of_packets;
1734 isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) *
1735 number_of_packets;
1736 isopkt = memdup_user(iso_frame_desc, isofrmlen);
1737 if (IS_ERR(isopkt)) {
1738 ret = PTR_ERR(isopkt);
1739 isopkt = NULL;
1740 goto error;
1741 }
1742 for (totlen = u = 0; u < number_of_packets; u++) {
1743 /*
1744 * arbitrary limit need for USB 3.1 Gen2
1745 * sizemax: 96 DPs at SSP, 96 * 1024 = 98304
1746 */
1747 if (isopkt[u].length > 98304) {
1748 ret = -EINVAL;
1749 goto error;
1750 }
1751 totlen += isopkt[u].length;
1752 }
1753 u *= sizeof(struct usb_iso_packet_descriptor);
1754 uurb->buffer_length = totlen;
1755 break;
1756
1757 default:
1758 return -EINVAL;
1759 }
1760
1761 if (uurb->buffer_length > 0 &&
1762 !access_ok(uurb->buffer, uurb->buffer_length)) {
1763 ret = -EFAULT;
1764 goto error;
1765 }
1766 as = alloc_async(number_of_packets);
1767 if (!as) {
1768 ret = -ENOMEM;
1769 goto error;
1770 }
1771
1772 as->usbm = find_memory_area(ps, uurb);
1773 if (IS_ERR(as->usbm)) {
1774 ret = PTR_ERR(as->usbm);
1775 as->usbm = NULL;
1776 goto error;
1777 }
1778
1779 /* do not use SG buffers when memory mapped segments
1780 * are in use
1781 */
1782 if (as->usbm)
1783 num_sgs = 0;
1784
1785 u += sizeof(struct async) + sizeof(struct urb) +
1786 (as->usbm ? 0 : uurb->buffer_length) +
1787 num_sgs * sizeof(struct scatterlist);
1788 ret = usbfs_increase_memory_usage(u);
1789 if (ret)
1790 goto error;
1791 as->mem_usage = u;
1792
1793 if (num_sgs) {
1794 as->urb->sg = kmalloc_array(num_sgs,
1795 sizeof(struct scatterlist),
1796 GFP_KERNEL | __GFP_NOWARN);
1797 if (!as->urb->sg) {
1798 ret = -ENOMEM;
1799 goto error;
1800 }
1801 as->urb->num_sgs = num_sgs;
1802 sg_init_table(as->urb->sg, as->urb->num_sgs);
1803
1804 totlen = uurb->buffer_length;
1805 for (i = 0; i < as->urb->num_sgs; i++) {
1806 u = (totlen > USB_SG_SIZE) ? USB_SG_SIZE : totlen;
1807 buf = kmalloc(u, GFP_KERNEL);
1808 if (!buf) {
1809 ret = -ENOMEM;
1810 goto error;
1811 }
1812 sg_set_buf(&as->urb->sg[i], buf, u);
1813
1814 if (!is_in) {
1815 if (copy_from_user(buf, uurb->buffer, u)) {
1816 ret = -EFAULT;
1817 goto error;
1818 }
1819 uurb->buffer += u;
1820 }
1821 totlen -= u;
1822 }
1823 } else if (uurb->buffer_length > 0) {
1824 if (as->usbm) {
1825 unsigned long uurb_start = (unsigned long)uurb->buffer;
1826
1827 as->urb->transfer_buffer = as->usbm->mem +
1828 (uurb_start - as->usbm->vm_start);
1829 } else {
1830 as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
1831 GFP_KERNEL | __GFP_NOWARN);
1832 if (!as->urb->transfer_buffer) {
1833 ret = -ENOMEM;
1834 goto error;
1835 }
1836 if (!is_in) {
1837 if (copy_from_user(as->urb->transfer_buffer,
1838 uurb->buffer,
1839 uurb->buffer_length)) {
1840 ret = -EFAULT;
1841 goto error;
1842 }
1843 } else if (uurb->type == USBDEVFS_URB_TYPE_ISO) {
1844 /*
1845 * Isochronous input data may end up being
1846 * discontiguous if some of the packets are
1847 * short. Clear the buffer so that the gaps
1848 * don't leak kernel data to userspace.
1849 */
1850 memset(as->urb->transfer_buffer, 0,
1851 uurb->buffer_length);
1852 }
1853 }
1854 }
1855 as->urb->dev = ps->dev;
1856 as->urb->pipe = (uurb->type << 30) |
1857 __create_pipe(ps->dev, uurb->endpoint & 0xf) |
1858 (uurb->endpoint & USB_DIR_IN);
1859
1860 /* This tedious sequence is necessary because the URB_* flags
1861 * are internal to the kernel and subject to change, whereas
1862 * the USBDEVFS_URB_* flags are a user API and must not be changed.
1863 */
1864 u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
1865 if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
1866 u |= URB_ISO_ASAP;
1867 if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
1868 u |= URB_SHORT_NOT_OK;
1869 if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
1870 u |= URB_ZERO_PACKET;
1871 if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
1872 u |= URB_NO_INTERRUPT;
1873 as->urb->transfer_flags = u;
1874
1875 if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
1876 dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
1877 if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
1878 dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
1879
1880 as->urb->transfer_buffer_length = uurb->buffer_length;
1881 as->urb->setup_packet = (unsigned char *)dr;
1882 dr = NULL;
1883 as->urb->start_frame = uurb->start_frame;
1884 as->urb->number_of_packets = number_of_packets;
1885 as->urb->stream_id = stream_id;
1886
1887 if (ep->desc.bInterval) {
1888 if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
1889 ps->dev->speed == USB_SPEED_HIGH ||
1890 ps->dev->speed >= USB_SPEED_SUPER)
1891 as->urb->interval = 1 <<
1892 min(15, ep->desc.bInterval - 1);
1893 else
1894 as->urb->interval = ep->desc.bInterval;
1895 }
1896
1897 as->urb->context = as;
1898 as->urb->complete = async_completed;
1899 for (totlen = u = 0; u < number_of_packets; u++) {
1900 as->urb->iso_frame_desc[u].offset = totlen;
1901 as->urb->iso_frame_desc[u].length = isopkt[u].length;
1902 totlen += isopkt[u].length;
1903 }
1904 kfree(isopkt);
1905 isopkt = NULL;
1906 as->ps = ps;
1907 as->userurb = arg;
1908 as->userurb_sigval = userurb_sigval;
1909 if (as->usbm) {
1910 unsigned long uurb_start = (unsigned long)uurb->buffer;
1911
1912 as->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1913 as->urb->transfer_dma = as->usbm->dma_handle +
1914 (uurb_start - as->usbm->vm_start);
1915 } else if (is_in && uurb->buffer_length > 0)
1916 as->userbuffer = uurb->buffer;
1917 as->signr = uurb->signr;
1918 as->ifnum = ifnum;
1919 as->pid = get_pid(task_pid(current));
1920 as->cred = get_current_cred();
1921 snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1922 as->urb->transfer_buffer_length, 0, SUBMIT,
1923 NULL, 0);
1924 if (!is_in)
1925 snoop_urb_data(as->urb, as->urb->transfer_buffer_length);
1926
1927 async_newpending(as);
1928
1929 if (usb_endpoint_xfer_bulk(&ep->desc)) {
1930 spin_lock_irq(&ps->lock);
1931
1932 /* Not exactly the endpoint address; the direction bit is
1933 * shifted to the 0x10 position so that the value will be
1934 * between 0 and 31.
1935 */
1936 as->bulk_addr = usb_endpoint_num(&ep->desc) |
1937 ((ep->desc.bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1938 >> 3);
1939
1940 /* If this bulk URB is the start of a new transfer, re-enable
1941 * the endpoint. Otherwise mark it as a continuation URB.
1942 */
1943 if (uurb->flags & USBDEVFS_URB_BULK_CONTINUATION)
1944 as->bulk_status = AS_CONTINUATION;
1945 else
1946 ps->disabled_bulk_eps &= ~(1 << as->bulk_addr);
1947
1948 /* Don't accept continuation URBs if the endpoint is
1949 * disabled because of an earlier error.
1950 */
1951 if (ps->disabled_bulk_eps & (1 << as->bulk_addr))
1952 ret = -EREMOTEIO;
1953 else
1954 ret = usb_submit_urb(as->urb, GFP_ATOMIC);
1955 spin_unlock_irq(&ps->lock);
1956 } else {
1957 ret = usb_submit_urb(as->urb, GFP_KERNEL);
1958 }
1959
1960 if (ret) {
1961 dev_printk(KERN_DEBUG, &ps->dev->dev,
1962 "usbfs: usb_submit_urb returned %d\n", ret);
1963 snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1964 0, ret, COMPLETE, NULL, 0);
1965 async_removepending(as);
1966 goto error;
1967 }
1968 return 0;
1969
1970 error:
1971 kfree(isopkt);
1972 kfree(dr);
1973 if (as)
1974 free_async(as);
1975 return ret;
1976 }
1977
proc_submiturb(struct usb_dev_state * ps,void __user * arg)1978 static int proc_submiturb(struct usb_dev_state *ps, void __user *arg)
1979 {
1980 struct usbdevfs_urb uurb;
1981 sigval_t userurb_sigval;
1982
1983 if (copy_from_user(&uurb, arg, sizeof(uurb)))
1984 return -EFAULT;
1985
1986 memset(&userurb_sigval, 0, sizeof(userurb_sigval));
1987 userurb_sigval.sival_ptr = arg;
1988
1989 return proc_do_submiturb(ps, &uurb,
1990 (((struct usbdevfs_urb __user *)arg)->iso_frame_desc),
1991 arg, userurb_sigval);
1992 }
1993
proc_unlinkurb(struct usb_dev_state * ps,void __user * arg)1994 static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg)
1995 {
1996 struct urb *urb;
1997 struct async *as;
1998 unsigned long flags;
1999
2000 spin_lock_irqsave(&ps->lock, flags);
2001 as = async_getpending(ps, arg);
2002 if (!as) {
2003 spin_unlock_irqrestore(&ps->lock, flags);
2004 return -EINVAL;
2005 }
2006
2007 urb = as->urb;
2008 usb_get_urb(urb);
2009 spin_unlock_irqrestore(&ps->lock, flags);
2010
2011 usb_kill_urb(urb);
2012 usb_put_urb(urb);
2013
2014 return 0;
2015 }
2016
compute_isochronous_actual_length(struct urb * urb)2017 static void compute_isochronous_actual_length(struct urb *urb)
2018 {
2019 unsigned int i;
2020
2021 if (urb->number_of_packets > 0) {
2022 urb->actual_length = 0;
2023 for (i = 0; i < urb->number_of_packets; i++)
2024 urb->actual_length +=
2025 urb->iso_frame_desc[i].actual_length;
2026 }
2027 }
2028
processcompl(struct async * as,void __user * __user * arg)2029 static int processcompl(struct async *as, void __user * __user *arg)
2030 {
2031 struct urb *urb = as->urb;
2032 struct usbdevfs_urb __user *userurb = as->userurb;
2033 void __user *addr = as->userurb;
2034 unsigned int i;
2035
2036 compute_isochronous_actual_length(urb);
2037 if (as->userbuffer && urb->actual_length) {
2038 if (copy_urb_data_to_user(as->userbuffer, urb))
2039 goto err_out;
2040 }
2041 if (put_user(as->status, &userurb->status))
2042 goto err_out;
2043 if (put_user(urb->actual_length, &userurb->actual_length))
2044 goto err_out;
2045 if (put_user(urb->error_count, &userurb->error_count))
2046 goto err_out;
2047
2048 if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
2049 for (i = 0; i < urb->number_of_packets; i++) {
2050 if (put_user(urb->iso_frame_desc[i].actual_length,
2051 &userurb->iso_frame_desc[i].actual_length))
2052 goto err_out;
2053 if (put_user(urb->iso_frame_desc[i].status,
2054 &userurb->iso_frame_desc[i].status))
2055 goto err_out;
2056 }
2057 }
2058
2059 if (put_user(addr, (void __user * __user *)arg))
2060 return -EFAULT;
2061 return 0;
2062
2063 err_out:
2064 return -EFAULT;
2065 }
2066
reap_as(struct usb_dev_state * ps)2067 static struct async *reap_as(struct usb_dev_state *ps)
2068 {
2069 DECLARE_WAITQUEUE(wait, current);
2070 struct async *as = NULL;
2071 struct usb_device *dev = ps->dev;
2072
2073 add_wait_queue(&ps->wait, &wait);
2074 for (;;) {
2075 __set_current_state(TASK_INTERRUPTIBLE);
2076 as = async_getcompleted(ps);
2077 if (as || !connected(ps))
2078 break;
2079 if (signal_pending(current))
2080 break;
2081 usb_unlock_device(dev);
2082 schedule();
2083 usb_lock_device(dev);
2084 }
2085 remove_wait_queue(&ps->wait, &wait);
2086 set_current_state(TASK_RUNNING);
2087 return as;
2088 }
2089
proc_reapurb(struct usb_dev_state * ps,void __user * arg)2090 static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
2091 {
2092 struct async *as = reap_as(ps);
2093
2094 if (as) {
2095 int retval;
2096
2097 snoop(&ps->dev->dev, "reap %px\n", as->userurb);
2098 retval = processcompl(as, (void __user * __user *)arg);
2099 free_async(as);
2100 return retval;
2101 }
2102 if (signal_pending(current))
2103 return -EINTR;
2104 return -ENODEV;
2105 }
2106
proc_reapurbnonblock(struct usb_dev_state * ps,void __user * arg)2107 static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
2108 {
2109 int retval;
2110 struct async *as;
2111
2112 as = async_getcompleted(ps);
2113 if (as) {
2114 snoop(&ps->dev->dev, "reap %px\n", as->userurb);
2115 retval = processcompl(as, (void __user * __user *)arg);
2116 free_async(as);
2117 } else {
2118 retval = (connected(ps) ? -EAGAIN : -ENODEV);
2119 }
2120 return retval;
2121 }
2122
2123 #ifdef CONFIG_COMPAT
proc_control_compat(struct usb_dev_state * ps,struct usbdevfs_ctrltransfer32 __user * p32)2124 static int proc_control_compat(struct usb_dev_state *ps,
2125 struct usbdevfs_ctrltransfer32 __user *p32)
2126 {
2127 struct usbdevfs_ctrltransfer ctrl;
2128 u32 udata;
2129
2130 if (copy_from_user(&ctrl, p32, sizeof(*p32) - sizeof(compat_caddr_t)) ||
2131 get_user(udata, &p32->data))
2132 return -EFAULT;
2133 ctrl.data = compat_ptr(udata);
2134 return do_proc_control(ps, &ctrl);
2135 }
2136
proc_bulk_compat(struct usb_dev_state * ps,struct usbdevfs_bulktransfer32 __user * p32)2137 static int proc_bulk_compat(struct usb_dev_state *ps,
2138 struct usbdevfs_bulktransfer32 __user *p32)
2139 {
2140 struct usbdevfs_bulktransfer bulk;
2141 compat_caddr_t addr;
2142
2143 if (get_user(bulk.ep, &p32->ep) ||
2144 get_user(bulk.len, &p32->len) ||
2145 get_user(bulk.timeout, &p32->timeout) ||
2146 get_user(addr, &p32->data))
2147 return -EFAULT;
2148 bulk.data = compat_ptr(addr);
2149 return do_proc_bulk(ps, &bulk);
2150 }
2151
proc_disconnectsignal_compat(struct usb_dev_state * ps,void __user * arg)2152 static int proc_disconnectsignal_compat(struct usb_dev_state *ps, void __user *arg)
2153 {
2154 struct usbdevfs_disconnectsignal32 ds;
2155
2156 if (copy_from_user(&ds, arg, sizeof(ds)))
2157 return -EFAULT;
2158 ps->discsignr = ds.signr;
2159 ps->disccontext.sival_int = ds.context;
2160 return 0;
2161 }
2162
get_urb32(struct usbdevfs_urb * kurb,struct usbdevfs_urb32 __user * uurb)2163 static int get_urb32(struct usbdevfs_urb *kurb,
2164 struct usbdevfs_urb32 __user *uurb)
2165 {
2166 struct usbdevfs_urb32 urb32;
2167 if (copy_from_user(&urb32, uurb, sizeof(*uurb)))
2168 return -EFAULT;
2169 kurb->type = urb32.type;
2170 kurb->endpoint = urb32.endpoint;
2171 kurb->status = urb32.status;
2172 kurb->flags = urb32.flags;
2173 kurb->buffer = compat_ptr(urb32.buffer);
2174 kurb->buffer_length = urb32.buffer_length;
2175 kurb->actual_length = urb32.actual_length;
2176 kurb->start_frame = urb32.start_frame;
2177 kurb->number_of_packets = urb32.number_of_packets;
2178 kurb->error_count = urb32.error_count;
2179 kurb->signr = urb32.signr;
2180 kurb->usercontext = compat_ptr(urb32.usercontext);
2181 return 0;
2182 }
2183
proc_submiturb_compat(struct usb_dev_state * ps,void __user * arg)2184 static int proc_submiturb_compat(struct usb_dev_state *ps, void __user *arg)
2185 {
2186 struct usbdevfs_urb uurb;
2187 sigval_t userurb_sigval;
2188
2189 if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))
2190 return -EFAULT;
2191
2192 memset(&userurb_sigval, 0, sizeof(userurb_sigval));
2193 userurb_sigval.sival_int = ptr_to_compat(arg);
2194
2195 return proc_do_submiturb(ps, &uurb,
2196 ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc,
2197 arg, userurb_sigval);
2198 }
2199
processcompl_compat(struct async * as,void __user * __user * arg)2200 static int processcompl_compat(struct async *as, void __user * __user *arg)
2201 {
2202 struct urb *urb = as->urb;
2203 struct usbdevfs_urb32 __user *userurb = as->userurb;
2204 void __user *addr = as->userurb;
2205 unsigned int i;
2206
2207 compute_isochronous_actual_length(urb);
2208 if (as->userbuffer && urb->actual_length) {
2209 if (copy_urb_data_to_user(as->userbuffer, urb))
2210 return -EFAULT;
2211 }
2212 if (put_user(as->status, &userurb->status))
2213 return -EFAULT;
2214 if (put_user(urb->actual_length, &userurb->actual_length))
2215 return -EFAULT;
2216 if (put_user(urb->error_count, &userurb->error_count))
2217 return -EFAULT;
2218
2219 if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
2220 for (i = 0; i < urb->number_of_packets; i++) {
2221 if (put_user(urb->iso_frame_desc[i].actual_length,
2222 &userurb->iso_frame_desc[i].actual_length))
2223 return -EFAULT;
2224 if (put_user(urb->iso_frame_desc[i].status,
2225 &userurb->iso_frame_desc[i].status))
2226 return -EFAULT;
2227 }
2228 }
2229
2230 if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
2231 return -EFAULT;
2232 return 0;
2233 }
2234
proc_reapurb_compat(struct usb_dev_state * ps,void __user * arg)2235 static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
2236 {
2237 struct async *as = reap_as(ps);
2238
2239 if (as) {
2240 int retval;
2241
2242 snoop(&ps->dev->dev, "reap %px\n", as->userurb);
2243 retval = processcompl_compat(as, (void __user * __user *)arg);
2244 free_async(as);
2245 return retval;
2246 }
2247 if (signal_pending(current))
2248 return -EINTR;
2249 return -ENODEV;
2250 }
2251
proc_reapurbnonblock_compat(struct usb_dev_state * ps,void __user * arg)2252 static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *arg)
2253 {
2254 int retval;
2255 struct async *as;
2256
2257 as = async_getcompleted(ps);
2258 if (as) {
2259 snoop(&ps->dev->dev, "reap %px\n", as->userurb);
2260 retval = processcompl_compat(as, (void __user * __user *)arg);
2261 free_async(as);
2262 } else {
2263 retval = (connected(ps) ? -EAGAIN : -ENODEV);
2264 }
2265 return retval;
2266 }
2267
2268
2269 #endif
2270
proc_disconnectsignal(struct usb_dev_state * ps,void __user * arg)2271 static int proc_disconnectsignal(struct usb_dev_state *ps, void __user *arg)
2272 {
2273 struct usbdevfs_disconnectsignal ds;
2274
2275 if (copy_from_user(&ds, arg, sizeof(ds)))
2276 return -EFAULT;
2277 ps->discsignr = ds.signr;
2278 ps->disccontext.sival_ptr = ds.context;
2279 return 0;
2280 }
2281
proc_claiminterface(struct usb_dev_state * ps,void __user * arg)2282 static int proc_claiminterface(struct usb_dev_state *ps, void __user *arg)
2283 {
2284 unsigned int ifnum;
2285
2286 if (get_user(ifnum, (unsigned int __user *)arg))
2287 return -EFAULT;
2288 return claimintf(ps, ifnum);
2289 }
2290
proc_releaseinterface(struct usb_dev_state * ps,void __user * arg)2291 static int proc_releaseinterface(struct usb_dev_state *ps, void __user *arg)
2292 {
2293 unsigned int ifnum;
2294 int ret;
2295
2296 if (get_user(ifnum, (unsigned int __user *)arg))
2297 return -EFAULT;
2298 ret = releaseintf(ps, ifnum);
2299 if (ret < 0)
2300 return ret;
2301 destroy_async_on_interface(ps, ifnum);
2302 return 0;
2303 }
2304
proc_ioctl(struct usb_dev_state * ps,struct usbdevfs_ioctl * ctl)2305 static int proc_ioctl(struct usb_dev_state *ps, struct usbdevfs_ioctl *ctl)
2306 {
2307 int size;
2308 void *buf = NULL;
2309 int retval = 0;
2310 struct usb_interface *intf = NULL;
2311 struct usb_driver *driver = NULL;
2312
2313 if (ps->privileges_dropped)
2314 return -EACCES;
2315
2316 if (!connected(ps))
2317 return -ENODEV;
2318
2319 /* alloc buffer */
2320 size = _IOC_SIZE(ctl->ioctl_code);
2321 if (size > 0) {
2322 buf = kmalloc(size, GFP_KERNEL);
2323 if (buf == NULL)
2324 return -ENOMEM;
2325 if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
2326 if (copy_from_user(buf, ctl->data, size)) {
2327 kfree(buf);
2328 return -EFAULT;
2329 }
2330 } else {
2331 memset(buf, 0, size);
2332 }
2333 }
2334
2335 if (ps->dev->state != USB_STATE_CONFIGURED)
2336 retval = -EHOSTUNREACH;
2337 else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
2338 retval = -EINVAL;
2339 else switch (ctl->ioctl_code) {
2340
2341 /* disconnect kernel driver from interface */
2342 case USBDEVFS_DISCONNECT:
2343 if (intf->dev.driver) {
2344 driver = to_usb_driver(intf->dev.driver);
2345 dev_dbg(&intf->dev, "disconnect by usbfs\n");
2346 usb_driver_release_interface(driver, intf);
2347 } else
2348 retval = -ENODATA;
2349 break;
2350
2351 /* let kernel drivers try to (re)bind to the interface */
2352 case USBDEVFS_CONNECT:
2353 if (!intf->dev.driver)
2354 retval = device_attach(&intf->dev);
2355 else
2356 retval = -EBUSY;
2357 break;
2358
2359 /* talk directly to the interface's driver */
2360 default:
2361 if (intf->dev.driver)
2362 driver = to_usb_driver(intf->dev.driver);
2363 if (driver == NULL || driver->unlocked_ioctl == NULL) {
2364 retval = -ENOTTY;
2365 } else {
2366 retval = driver->unlocked_ioctl(intf, ctl->ioctl_code, buf);
2367 if (retval == -ENOIOCTLCMD)
2368 retval = -ENOTTY;
2369 }
2370 }
2371
2372 /* cleanup and return */
2373 if (retval >= 0
2374 && (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
2375 && size > 0
2376 && copy_to_user(ctl->data, buf, size) != 0)
2377 retval = -EFAULT;
2378
2379 kfree(buf);
2380 return retval;
2381 }
2382
proc_ioctl_default(struct usb_dev_state * ps,void __user * arg)2383 static int proc_ioctl_default(struct usb_dev_state *ps, void __user *arg)
2384 {
2385 struct usbdevfs_ioctl ctrl;
2386
2387 if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
2388 return -EFAULT;
2389 return proc_ioctl(ps, &ctrl);
2390 }
2391
2392 #ifdef CONFIG_COMPAT
proc_ioctl_compat(struct usb_dev_state * ps,compat_uptr_t arg)2393 static int proc_ioctl_compat(struct usb_dev_state *ps, compat_uptr_t arg)
2394 {
2395 struct usbdevfs_ioctl32 ioc32;
2396 struct usbdevfs_ioctl ctrl;
2397
2398 if (copy_from_user(&ioc32, compat_ptr(arg), sizeof(ioc32)))
2399 return -EFAULT;
2400 ctrl.ifno = ioc32.ifno;
2401 ctrl.ioctl_code = ioc32.ioctl_code;
2402 ctrl.data = compat_ptr(ioc32.data);
2403 return proc_ioctl(ps, &ctrl);
2404 }
2405 #endif
2406
proc_claim_port(struct usb_dev_state * ps,void __user * arg)2407 static int proc_claim_port(struct usb_dev_state *ps, void __user *arg)
2408 {
2409 unsigned portnum;
2410 int rc;
2411
2412 if (get_user(portnum, (unsigned __user *) arg))
2413 return -EFAULT;
2414 rc = usb_hub_claim_port(ps->dev, portnum, ps);
2415 if (rc == 0)
2416 snoop(&ps->dev->dev, "port %d claimed by process %d: %s\n",
2417 portnum, task_pid_nr(current), current->comm);
2418 return rc;
2419 }
2420
proc_release_port(struct usb_dev_state * ps,void __user * arg)2421 static int proc_release_port(struct usb_dev_state *ps, void __user *arg)
2422 {
2423 unsigned portnum;
2424
2425 if (get_user(portnum, (unsigned __user *) arg))
2426 return -EFAULT;
2427 return usb_hub_release_port(ps->dev, portnum, ps);
2428 }
2429
proc_get_capabilities(struct usb_dev_state * ps,void __user * arg)2430 static int proc_get_capabilities(struct usb_dev_state *ps, void __user *arg)
2431 {
2432 __u32 caps;
2433
2434 caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
2435 USBDEVFS_CAP_REAP_AFTER_DISCONNECT | USBDEVFS_CAP_MMAP |
2436 USBDEVFS_CAP_DROP_PRIVILEGES |
2437 USBDEVFS_CAP_CONNINFO_EX | MAYBE_CAP_SUSPEND;
2438 if (!ps->dev->bus->no_stop_on_short)
2439 caps |= USBDEVFS_CAP_BULK_CONTINUATION;
2440 if (ps->dev->bus->sg_tablesize)
2441 caps |= USBDEVFS_CAP_BULK_SCATTER_GATHER;
2442
2443 if (put_user(caps, (__u32 __user *)arg))
2444 return -EFAULT;
2445
2446 return 0;
2447 }
2448
proc_disconnect_claim(struct usb_dev_state * ps,void __user * arg)2449 static int proc_disconnect_claim(struct usb_dev_state *ps, void __user *arg)
2450 {
2451 struct usbdevfs_disconnect_claim dc;
2452 struct usb_interface *intf;
2453
2454 if (copy_from_user(&dc, arg, sizeof(dc)))
2455 return -EFAULT;
2456
2457 intf = usb_ifnum_to_if(ps->dev, dc.interface);
2458 if (!intf)
2459 return -EINVAL;
2460
2461 if (intf->dev.driver) {
2462 struct usb_driver *driver = to_usb_driver(intf->dev.driver);
2463
2464 if (ps->privileges_dropped)
2465 return -EACCES;
2466
2467 if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_IF_DRIVER) &&
2468 strncmp(dc.driver, intf->dev.driver->name,
2469 sizeof(dc.driver)) != 0)
2470 return -EBUSY;
2471
2472 if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_EXCEPT_DRIVER) &&
2473 strncmp(dc.driver, intf->dev.driver->name,
2474 sizeof(dc.driver)) == 0)
2475 return -EBUSY;
2476
2477 dev_dbg(&intf->dev, "disconnect by usbfs\n");
2478 usb_driver_release_interface(driver, intf);
2479 }
2480
2481 return claimintf(ps, dc.interface);
2482 }
2483
proc_alloc_streams(struct usb_dev_state * ps,void __user * arg)2484 static int proc_alloc_streams(struct usb_dev_state *ps, void __user *arg)
2485 {
2486 unsigned num_streams, num_eps;
2487 struct usb_host_endpoint **eps;
2488 struct usb_interface *intf;
2489 int r;
2490
2491 r = parse_usbdevfs_streams(ps, arg, &num_streams, &num_eps,
2492 &eps, &intf);
2493 if (r)
2494 return r;
2495
2496 destroy_async_on_interface(ps,
2497 intf->altsetting[0].desc.bInterfaceNumber);
2498
2499 r = usb_alloc_streams(intf, eps, num_eps, num_streams, GFP_KERNEL);
2500 kfree(eps);
2501 return r;
2502 }
2503
proc_free_streams(struct usb_dev_state * ps,void __user * arg)2504 static int proc_free_streams(struct usb_dev_state *ps, void __user *arg)
2505 {
2506 unsigned num_eps;
2507 struct usb_host_endpoint **eps;
2508 struct usb_interface *intf;
2509 int r;
2510
2511 r = parse_usbdevfs_streams(ps, arg, NULL, &num_eps, &eps, &intf);
2512 if (r)
2513 return r;
2514
2515 destroy_async_on_interface(ps,
2516 intf->altsetting[0].desc.bInterfaceNumber);
2517
2518 r = usb_free_streams(intf, eps, num_eps, GFP_KERNEL);
2519 kfree(eps);
2520 return r;
2521 }
2522
proc_drop_privileges(struct usb_dev_state * ps,void __user * arg)2523 static int proc_drop_privileges(struct usb_dev_state *ps, void __user *arg)
2524 {
2525 u32 data;
2526
2527 if (copy_from_user(&data, arg, sizeof(data)))
2528 return -EFAULT;
2529
2530 /* This is a one way operation. Once privileges are
2531 * dropped, you cannot regain them. You may however reissue
2532 * this ioctl to shrink the allowed interfaces mask.
2533 */
2534 ps->interface_allowed_mask &= data;
2535 ps->privileges_dropped = true;
2536
2537 return 0;
2538 }
2539
proc_forbid_suspend(struct usb_dev_state * ps)2540 static int proc_forbid_suspend(struct usb_dev_state *ps)
2541 {
2542 int ret = 0;
2543
2544 if (ps->suspend_allowed) {
2545 ret = usb_autoresume_device(ps->dev);
2546 if (ret == 0)
2547 ps->suspend_allowed = false;
2548 else if (ret != -ENODEV)
2549 ret = -EIO;
2550 }
2551 return ret;
2552 }
2553
proc_allow_suspend(struct usb_dev_state * ps)2554 static int proc_allow_suspend(struct usb_dev_state *ps)
2555 {
2556 if (!connected(ps))
2557 return -ENODEV;
2558
2559 WRITE_ONCE(ps->not_yet_resumed, 1);
2560 if (!ps->suspend_allowed) {
2561 usb_autosuspend_device(ps->dev);
2562 ps->suspend_allowed = true;
2563 }
2564 return 0;
2565 }
2566
proc_wait_for_resume(struct usb_dev_state * ps)2567 static int proc_wait_for_resume(struct usb_dev_state *ps)
2568 {
2569 int ret;
2570
2571 usb_unlock_device(ps->dev);
2572 ret = wait_event_interruptible(ps->wait_for_resume,
2573 READ_ONCE(ps->not_yet_resumed) == 0);
2574 usb_lock_device(ps->dev);
2575
2576 if (ret != 0)
2577 return -EINTR;
2578 return proc_forbid_suspend(ps);
2579 }
2580
2581 /*
2582 * NOTE: All requests here that have interface numbers as parameters
2583 * are assuming that somehow the configuration has been prevented from
2584 * changing. But there's no mechanism to ensure that...
2585 */
usbdev_do_ioctl(struct file * file,unsigned int cmd,void __user * p)2586 static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
2587 void __user *p)
2588 {
2589 struct usb_dev_state *ps = file->private_data;
2590 struct inode *inode = file_inode(file);
2591 struct usb_device *dev = ps->dev;
2592 int ret = -ENOTTY;
2593
2594 if (!(file->f_mode & FMODE_WRITE))
2595 return -EPERM;
2596
2597 usb_lock_device(dev);
2598
2599 /* Reap operations are allowed even after disconnection */
2600 switch (cmd) {
2601 case USBDEVFS_REAPURB:
2602 snoop(&dev->dev, "%s: REAPURB\n", __func__);
2603 ret = proc_reapurb(ps, p);
2604 goto done;
2605
2606 case USBDEVFS_REAPURBNDELAY:
2607 snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
2608 ret = proc_reapurbnonblock(ps, p);
2609 goto done;
2610
2611 #ifdef CONFIG_COMPAT
2612 case USBDEVFS_REAPURB32:
2613 snoop(&dev->dev, "%s: REAPURB32\n", __func__);
2614 ret = proc_reapurb_compat(ps, p);
2615 goto done;
2616
2617 case USBDEVFS_REAPURBNDELAY32:
2618 snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
2619 ret = proc_reapurbnonblock_compat(ps, p);
2620 goto done;
2621 #endif
2622 }
2623
2624 if (!connected(ps)) {
2625 usb_unlock_device(dev);
2626 return -ENODEV;
2627 }
2628
2629 switch (cmd) {
2630 case USBDEVFS_CONTROL:
2631 snoop(&dev->dev, "%s: CONTROL\n", __func__);
2632 ret = proc_control(ps, p);
2633 if (ret >= 0)
2634 inode->i_mtime = current_time(inode);
2635 break;
2636
2637 case USBDEVFS_BULK:
2638 snoop(&dev->dev, "%s: BULK\n", __func__);
2639 ret = proc_bulk(ps, p);
2640 if (ret >= 0)
2641 inode->i_mtime = current_time(inode);
2642 break;
2643
2644 case USBDEVFS_RESETEP:
2645 snoop(&dev->dev, "%s: RESETEP\n", __func__);
2646 ret = proc_resetep(ps, p);
2647 if (ret >= 0)
2648 inode->i_mtime = current_time(inode);
2649 break;
2650
2651 case USBDEVFS_RESET:
2652 snoop(&dev->dev, "%s: RESET\n", __func__);
2653 ret = proc_resetdevice(ps);
2654 break;
2655
2656 case USBDEVFS_CLEAR_HALT:
2657 snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
2658 ret = proc_clearhalt(ps, p);
2659 if (ret >= 0)
2660 inode->i_mtime = current_time(inode);
2661 break;
2662
2663 case USBDEVFS_GETDRIVER:
2664 snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
2665 ret = proc_getdriver(ps, p);
2666 break;
2667
2668 case USBDEVFS_CONNECTINFO:
2669 snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
2670 ret = proc_connectinfo(ps, p);
2671 break;
2672
2673 case USBDEVFS_SETINTERFACE:
2674 snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
2675 ret = proc_setintf(ps, p);
2676 break;
2677
2678 case USBDEVFS_SETCONFIGURATION:
2679 snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
2680 ret = proc_setconfig(ps, p);
2681 break;
2682
2683 case USBDEVFS_SUBMITURB:
2684 snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
2685 ret = proc_submiturb(ps, p);
2686 if (ret >= 0)
2687 inode->i_mtime = current_time(inode);
2688 break;
2689
2690 #ifdef CONFIG_COMPAT
2691 case USBDEVFS_CONTROL32:
2692 snoop(&dev->dev, "%s: CONTROL32\n", __func__);
2693 ret = proc_control_compat(ps, p);
2694 if (ret >= 0)
2695 inode->i_mtime = current_time(inode);
2696 break;
2697
2698 case USBDEVFS_BULK32:
2699 snoop(&dev->dev, "%s: BULK32\n", __func__);
2700 ret = proc_bulk_compat(ps, p);
2701 if (ret >= 0)
2702 inode->i_mtime = current_time(inode);
2703 break;
2704
2705 case USBDEVFS_DISCSIGNAL32:
2706 snoop(&dev->dev, "%s: DISCSIGNAL32\n", __func__);
2707 ret = proc_disconnectsignal_compat(ps, p);
2708 break;
2709
2710 case USBDEVFS_SUBMITURB32:
2711 snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
2712 ret = proc_submiturb_compat(ps, p);
2713 if (ret >= 0)
2714 inode->i_mtime = current_time(inode);
2715 break;
2716
2717 case USBDEVFS_IOCTL32:
2718 snoop(&dev->dev, "%s: IOCTL32\n", __func__);
2719 ret = proc_ioctl_compat(ps, ptr_to_compat(p));
2720 break;
2721 #endif
2722
2723 case USBDEVFS_DISCARDURB:
2724 snoop(&dev->dev, "%s: DISCARDURB %px\n", __func__, p);
2725 ret = proc_unlinkurb(ps, p);
2726 break;
2727
2728 case USBDEVFS_DISCSIGNAL:
2729 snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
2730 ret = proc_disconnectsignal(ps, p);
2731 break;
2732
2733 case USBDEVFS_CLAIMINTERFACE:
2734 snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
2735 ret = proc_claiminterface(ps, p);
2736 break;
2737
2738 case USBDEVFS_RELEASEINTERFACE:
2739 snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
2740 ret = proc_releaseinterface(ps, p);
2741 break;
2742
2743 case USBDEVFS_IOCTL:
2744 snoop(&dev->dev, "%s: IOCTL\n", __func__);
2745 ret = proc_ioctl_default(ps, p);
2746 break;
2747
2748 case USBDEVFS_CLAIM_PORT:
2749 snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
2750 ret = proc_claim_port(ps, p);
2751 break;
2752
2753 case USBDEVFS_RELEASE_PORT:
2754 snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
2755 ret = proc_release_port(ps, p);
2756 break;
2757 case USBDEVFS_GET_CAPABILITIES:
2758 ret = proc_get_capabilities(ps, p);
2759 break;
2760 case USBDEVFS_DISCONNECT_CLAIM:
2761 ret = proc_disconnect_claim(ps, p);
2762 break;
2763 case USBDEVFS_ALLOC_STREAMS:
2764 ret = proc_alloc_streams(ps, p);
2765 break;
2766 case USBDEVFS_FREE_STREAMS:
2767 ret = proc_free_streams(ps, p);
2768 break;
2769 case USBDEVFS_DROP_PRIVILEGES:
2770 ret = proc_drop_privileges(ps, p);
2771 break;
2772 case USBDEVFS_GET_SPEED:
2773 ret = ps->dev->speed;
2774 break;
2775 case USBDEVFS_FORBID_SUSPEND:
2776 ret = proc_forbid_suspend(ps);
2777 break;
2778 case USBDEVFS_ALLOW_SUSPEND:
2779 ret = proc_allow_suspend(ps);
2780 break;
2781 case USBDEVFS_WAIT_FOR_RESUME:
2782 ret = proc_wait_for_resume(ps);
2783 break;
2784 }
2785
2786 /* Handle variable-length commands */
2787 switch (cmd & ~IOCSIZE_MASK) {
2788 case USBDEVFS_CONNINFO_EX(0):
2789 ret = proc_conninfo_ex(ps, p, _IOC_SIZE(cmd));
2790 break;
2791 }
2792
2793 done:
2794 usb_unlock_device(dev);
2795 if (ret >= 0)
2796 inode->i_atime = current_time(inode);
2797 return ret;
2798 }
2799
usbdev_ioctl(struct file * file,unsigned int cmd,unsigned long arg)2800 static long usbdev_ioctl(struct file *file, unsigned int cmd,
2801 unsigned long arg)
2802 {
2803 int ret;
2804
2805 ret = usbdev_do_ioctl(file, cmd, (void __user *)arg);
2806
2807 return ret;
2808 }
2809
2810 /* No kernel lock - fine */
usbdev_poll(struct file * file,struct poll_table_struct * wait)2811 static __poll_t usbdev_poll(struct file *file,
2812 struct poll_table_struct *wait)
2813 {
2814 struct usb_dev_state *ps = file->private_data;
2815 __poll_t mask = 0;
2816
2817 poll_wait(file, &ps->wait, wait);
2818 if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
2819 mask |= EPOLLOUT | EPOLLWRNORM;
2820 if (!connected(ps))
2821 mask |= EPOLLHUP;
2822 if (list_empty(&ps->list))
2823 mask |= EPOLLERR;
2824 return mask;
2825 }
2826
2827 const struct file_operations usbdev_file_operations = {
2828 .owner = THIS_MODULE,
2829 .llseek = no_seek_end_llseek,
2830 .read = usbdev_read,
2831 .poll = usbdev_poll,
2832 .unlocked_ioctl = usbdev_ioctl,
2833 .compat_ioctl = compat_ptr_ioctl,
2834 .mmap = usbdev_mmap,
2835 .open = usbdev_open,
2836 .release = usbdev_release,
2837 };
2838
usbdev_remove(struct usb_device * udev)2839 static void usbdev_remove(struct usb_device *udev)
2840 {
2841 struct usb_dev_state *ps;
2842
2843 /* Protect against simultaneous resume */
2844 mutex_lock(&usbfs_mutex);
2845 while (!list_empty(&udev->filelist)) {
2846 ps = list_entry(udev->filelist.next, struct usb_dev_state, list);
2847 destroy_all_async(ps);
2848 wake_up_all(&ps->wait);
2849 WRITE_ONCE(ps->not_yet_resumed, 0);
2850 wake_up_all(&ps->wait_for_resume);
2851 list_del_init(&ps->list);
2852 if (ps->discsignr)
2853 kill_pid_usb_asyncio(ps->discsignr, EPIPE, ps->disccontext,
2854 ps->disc_pid, ps->cred);
2855 }
2856 mutex_unlock(&usbfs_mutex);
2857 }
2858
usbdev_notify(struct notifier_block * self,unsigned long action,void * dev)2859 static int usbdev_notify(struct notifier_block *self,
2860 unsigned long action, void *dev)
2861 {
2862 switch (action) {
2863 case USB_DEVICE_ADD:
2864 break;
2865 case USB_DEVICE_REMOVE:
2866 usbdev_remove(dev);
2867 break;
2868 }
2869 return NOTIFY_OK;
2870 }
2871
2872 static struct notifier_block usbdev_nb = {
2873 .notifier_call = usbdev_notify,
2874 };
2875
2876 static struct cdev usb_device_cdev;
2877
usb_devio_init(void)2878 int __init usb_devio_init(void)
2879 {
2880 int retval;
2881
2882 retval = register_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX,
2883 "usb_device");
2884 if (retval) {
2885 printk(KERN_ERR "Unable to register minors for usb_device\n");
2886 goto out;
2887 }
2888 cdev_init(&usb_device_cdev, &usbdev_file_operations);
2889 retval = cdev_add(&usb_device_cdev, USB_DEVICE_DEV, USB_DEVICE_MAX);
2890 if (retval) {
2891 printk(KERN_ERR "Unable to get usb_device major %d\n",
2892 USB_DEVICE_MAJOR);
2893 goto error_cdev;
2894 }
2895 usb_register_notify(&usbdev_nb);
2896 out:
2897 return retval;
2898
2899 error_cdev:
2900 unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2901 goto out;
2902 }
2903
usb_devio_cleanup(void)2904 void usb_devio_cleanup(void)
2905 {
2906 usb_unregister_notify(&usbdev_nb);
2907 cdev_del(&usb_device_cdev);
2908 unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2909 }
2910