NetBSD/sys/dev/usb
maxv 8fdfc138ab Fix buffer overflows. sc_{o,f}len are controlled by the USB device. By
crafting the former the device can leak stack data. By crafting the latter
the device can overwrite the stack. The combination of the two means the
device can ROP the kernel and obtain code execution (demonstrated with an
actual exploit over vHCI).

Truncate the lengths to the size of the buffers, and also drop sc_ilen
since it is unused. Patch tested with vHCI+kASan.
2020-01-01 09:03:00 +00:00
..
aubtfwl.c Rename min/max -> uimin/uimax for better honesty. 2018-09-03 16:29:22 +00:00
aubtfwlreg.h
auvitek_audio.c
auvitek_board.c
auvitek_dtv.c
auvitek_i2c.c Cleanup i2c bus acquire / release, centralizing all of the logic into 2019-12-22 23:23:29 +00:00
auvitek_video.c KNF 2019-01-22 06:46:21 +00:00
auvitek.c
auvitekreg.h
auvitekvar.h
ehci.c Remove a stray ' 2019-12-31 18:11:18 +00:00
ehcireg.h
ehcivar.h implement a gross hack to fix "boot -a" on systems with usb keyboards on 2018-09-18 02:00:06 +00:00
emdtv_board.c
emdtv_board.h
emdtv_dtv.c
emdtv_i2c.c Cleanup i2c bus acquire / release, centralizing all of the logic into 2019-12-22 23:23:29 +00:00
emdtv_ir.c
emdtv.c Rename min/max -> uimin/uimax for better honesty. 2018-09-03 16:29:22 +00:00
emdtvreg.h
emdtvvar.h
ezload.c
ezload.h
FILES
files.usb add mos(4) driver for Moschip MCS7730/MCS7830/MCS7832 usb ethernet. 2019-09-20 10:34:54 +00:00
if_athn_usb.c Fix error handling, to prevent kernel crashes when detaching an athn0 2019-09-14 12:36:35 +00:00
if_athn_usb.h Fix error handling, to prevent kernel crashes when detaching an athn0 2019-09-14 12:36:35 +00:00
if_atu.c s/transfered/transferred/ 2019-12-27 09:41:48 +00:00
if_atureg.h
if_aue.c convert aue(4) to usbnet(9). 2019-08-23 04:34:51 +00:00
if_auereg.h convert aue(4) to usbnet(9). 2019-08-23 04:34:51 +00:00
if_axe.c PR kern/54486 2019-08-26 17:26:33 +00:00
if_axen.c s/UBSNET_MII_DECL_DEFAULT/USBNET_MII_DECL_DEFAULT/. from sc.dying. 2019-08-23 04:32:57 +00:00
if_axenreg.h introduce a library of common code / backends to share code between 2019-07-31 09:13:16 +00:00
if_axereg.h move software parts out of the "reg" header. 2019-07-14 21:37:09 +00:00
if_bwfm_usb.c Merge the [pgoyette-compat] branch 2019-01-27 02:08:33 +00:00
if_cdce.c couple more changes to usbnet(9): 2019-08-20 06:37:06 +00:00
if_cdcereg.h move the software-only parts of cdce(4) out of if_cdcereg.h. 2019-06-22 04:35:46 +00:00
if_cue.c s/transfered/transferred/ 2019-12-27 09:41:48 +00:00
if_cuereg.h port cue(4), mue(4) and url(4) to usbnet(9). diffstat says: 2019-08-15 08:02:32 +00:00
if_kue.c couple more changes to usbnet(9): 2019-08-20 06:37:06 +00:00
if_kuereg.h port kue(4) to usbnet(9). interesting notes: 2019-08-16 08:51:09 +00:00
if_mos.c add mos(4) driver for Moschip MCS7730/MCS7830/MCS7832 usb ethernet. 2019-09-20 10:34:54 +00:00
if_mosreg.h add mos(4) driver for Moschip MCS7730/MCS7830/MCS7832 usb ethernet. 2019-09-20 10:34:54 +00:00
if_mue.c s/UBSNET_MII_DECL_DEFAULT/USBNET_MII_DECL_DEFAULT/. from sc.dying. 2019-08-23 04:32:57 +00:00
if_muereg.h port cue(4), mue(4) and url(4) to usbnet(9). diffstat says: 2019-08-15 08:02:32 +00:00
if_muevar.h port cue(4), mue(4) and url(4) to usbnet(9). diffstat says: 2019-08-15 08:02:32 +00:00
if_otus.c Fix NULL derefs, to prevent kernel crashes when detaching an otus0 device. 2019-09-14 12:37:34 +00:00
if_otusreg.h
if_otusvar.h remove __packed attribute from struct ieee80211_radiotap_header 2019-10-05 23:27:20 +00:00
if_rum.c remove explicit 'extern struct cfdriver <my>_cd;' and use ioconf.h 2019-05-05 03:17:54 +00:00
if_rumreg.h
if_rumvar.h remove __packed attribute from struct ieee80211_radiotap_header 2019-10-05 23:27:20 +00:00
if_run.c Code that's #if'ed out still ought to compile. 2019-12-19 15:17:30 +00:00
if_runvar.h Merge more changes from FreeBSD/OpenBSD. My two run(4) devices now work 2019-10-08 07:30:58 +00:00
if_smsc.c s/UBSNET_MII_DECL_DEFAULT/USBNET_MII_DECL_DEFAULT/. from sc.dying. 2019-08-23 04:32:57 +00:00
if_smscreg.h Fix an unused register field define 2019-08-12 08:40:09 +00:00
if_udav.c Avoid a warning 2019-10-07 09:37:16 +00:00
if_udavreg.h add a blank line after rcsid(s) 2019-08-10 02:32:27 +00:00
if_umb.c Protect network ioctls from non-authorized users. (Ilja Van Sprundel) 2019-12-17 04:54:36 +00:00
if_umbreg.h Add a port of the umb(4) driver from OpenBSD 2018-07-31 16:44:28 +00:00
if_upgt.c Fix error handling, to prevent kernel crashes when detaching an upgt0 2019-09-14 12:53:24 +00:00
if_upgtvar.h remove __packed attribute from struct ieee80211_radiotap_header 2019-10-05 23:27:20 +00:00
if_upl.c Make it compilable with UPL_DEBUG. 2019-09-13 07:47:39 +00:00
if_ural.c localify 2019-12-01 08:23:09 +00:00
if_uralreg.h Use unsigned (RAL_RF_BUSY). Found by KUBSan. 2019-07-25 11:10:38 +00:00
if_uralvar.h remove __packed attribute from struct ieee80211_radiotap_header 2019-10-05 23:27:20 +00:00
if_ure.c allocate a random mac address if on-chip mac is all zeroes. 2019-10-16 13:11:16 +00:00
if_urereg.h Apply FreeBSD r346028 from ganbold@f.o: 2019-04-12 03:32:06 +00:00
if_urevar.h missed commit should be paired with if_ure.c 1.20. 2019-08-09 06:46:35 +00:00
if_url.c don't try to set dying when we haven't usbnet_attach()d yet. 2019-08-30 05:59:17 +00:00
if_urlreg.h URL_TCR_IFG0 is not bit 4 but bit3. From OpenBSD. 2019-12-27 08:53:30 +00:00
if_urndis.c check if buf/bufsz are non-NULL before freeing. 2019-10-31 11:59:40 +00:00
if_urtw.c localify 2019-11-28 17:09:10 +00:00
if_urtwn.c Fix gross use-after-free. Found by a custom query on LGTM. 2019-12-13 14:10:32 +00:00
if_urtwnreg.h - Unify the "rtwn" and "urtwn" register definitions and initialization 2018-06-29 04:02:10 +00:00
if_urtwnvar.h remove __packed attribute from struct ieee80211_radiotap_header 2019-10-05 23:27:20 +00:00
if_urtwreg.h remove __packed attribute from struct ieee80211_radiotap_header 2019-10-05 23:27:20 +00:00
if_zyd.c localify 2019-11-28 17:09:10 +00:00
if_zydreg.h remove __packed attribute from struct ieee80211_radiotap_header 2019-10-05 23:27:20 +00:00
irmce.c PR kern/52931 Kernel panics with Atheros usb wireless interface 2018-01-21 13:57:11 +00:00
kue_fw.h
Makefile Add a port of the umb(4) driver from OpenBSD 2018-07-31 16:44:28 +00:00
Makefile.usbdevs
mbim.h Add a port of the umb(4) driver from OpenBSD 2018-07-31 16:44:28 +00:00
motg.c Fix assertion failures triggered by usbdi.c,v 1.182, when devices 2019-02-17 04:17:52 +00:00
motgreg.h
motgvar.h Stop potential misuse of vendor names and USB vendor IDs in root hub 2018-04-09 16:21:09 +00:00
ohci.c Preserve the toggleCarry bit in the Endpoint Descriptor in 2019-11-29 14:15:41 +00:00
ohcireg.h
ohcivar.h pull across abort fixes from nick-nhusb. add more abort fixes, using 2018-08-09 06:26:47 +00:00
pseye.c Rename min/max -> uimin/uimax for better honesty. 2018-09-03 16:29:22 +00:00
slurm.c KNF 2019-01-22 06:46:21 +00:00
stuirda.c remove explicit 'extern struct cfdriver <my>_cd;' and use ioconf.h 2019-05-05 03:17:54 +00:00
TODO - remove items that are fixed (usually in the distant past) 2019-08-23 07:13:03 +00:00
TODO.usbmp update the list of splusb drivers (it's grown unfortunately) and 2019-08-23 07:29:29 +00:00
u3g.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
ualea.c PR kern/52931 Kernel panics with Atheros usb wireless interface 2018-01-21 13:57:11 +00:00
uark.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
uatp.c KNF 2019-01-22 06:46:21 +00:00
uaudio.c localify 2019-12-01 08:23:09 +00:00
uaudioreg.h
uberry.c Remove clause 3 and 4 leftovers from TNF licenses in more sources. 2019-12-15 16:48:25 +00:00
ubsa_common.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
ubsa.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
ubsavar.h clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
ubt.c localify 2019-12-01 08:23:09 +00:00
uchcom.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
ucom.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
ucomvar.h clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
ucycom.c localify 2019-12-01 08:23:09 +00:00
udl.c s/transfered/transferred/ 2019-12-27 09:41:48 +00:00
udl.h Fix error handling, to prevent kernel crashes at detach time. The code is 2019-09-14 15:24:23 +00:00
udsbr.c localify 2019-12-01 08:23:09 +00:00
udsir.c Purge an ancient email address, use dsainty@NetBSD.org instead 2019-09-22 07:28:35 +00:00
uep.c localify 2019-12-01 08:23:09 +00:00
uftdi.c Support serial speeds up to 12mbaud with newer FTDI chips. 2019-09-13 20:50:45 +00:00
uftdireg.h Support serial speeds up to 12mbaud with newer FTDI chips. 2019-09-13 20:50:45 +00:00
ugen.c reading usbdi.c it looks like usbd_get_config_descriptor() can actually 2019-12-11 11:54:23 +00:00
ugensa.c Fix error handling, to prevent kernel crashes when detaching an ugensa0 2019-09-14 12:48:51 +00:00
ugraphire_rdesc.h Support some Wacom pen tablets: 2017-09-02 04:35:51 +00:00
uhci.c Fix assertion failures triggered by usbdi.c,v 1.182, when devices 2019-02-17 04:17:52 +00:00
uhcireg.h
uhcivar.h reorder some struct members to remove holes. 2018-09-17 08:27:41 +00:00
uhid.c minor adjustments, to avoid warnings on debug builds 2019-12-01 12:47:10 +00:00
uhidev.c localify 2019-12-06 07:12:38 +00:00
uhidev.h use sc_lock not sc_access_lock to check UHIDEV_OPEN. 2019-03-23 02:19:31 +00:00
uhmodem.c Claim suspend support. 2019-05-27 03:08:13 +00:00
uhso.c localify 2019-12-01 08:23:09 +00:00
uhub.c convert pairs of USBHIST_CALLED()+USBHIST_LOG*() into 2019-08-21 10:48:37 +00:00
uipad.c Remove clause 3 and 4 leftovers from TNF licenses in more sources. 2019-12-15 16:48:25 +00:00
uipaq.c Fix NULL deref, to prevent kernel crashes when detaching an uipaq0 device. 2019-09-14 12:46:00 +00:00
uirda.c localify 2019-12-06 07:12:38 +00:00
uirdavar.h
ukbd.c remove explicit 'extern struct cfdriver <my>_cd;' and use ioconf.h 2019-05-05 03:17:54 +00:00
ukbdvar.h
ukyopon.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
ukyopon.h
ulpireg.h
ulpt.c localify 2019-12-01 08:23:09 +00:00
umass_isdata.c move the deallocation of the protocol-specific softc into its own detach hook, 2019-02-10 19:23:55 +00:00
umass_isdata.h Merge support for SATA NCQ (Native Command Queueing) from jdolecek-ncq branch 2017-10-07 16:05:31 +00:00
umass_quirks.c Update the kernhist(9) kernel history code to address issues identified 2017-10-28 00:37:11 +00:00
umass_quirks.h
umass_scsipi.c in many device attach paths, allocate memory with M_WAITOK instead of M_NOWAIT 2019-11-10 21:16:21 +00:00
umass_scsipi.h move the deallocation of the protocol-specific softc into its own detach hook, 2019-02-10 19:23:55 +00:00
umass.c localify 2019-12-06 07:12:38 +00:00
umassvar.h Handle abort paths gracefully on detach. 2018-11-13 10:30:57 +00:00
umcs.c Fix error handling, to prevent kernel crashes when detaching an umcs0 2019-09-14 12:38:40 +00:00
umcs.h Fix typo (s/recevie/receive/). 2019-06-04 10:15:22 +00:00
umct.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
umct.h
umidi_quirks.c Merge isaki-audio2 branch, the overhaul of audio subsystem. 2019-05-08 13:40:13 +00:00
umidi_quirks.h
umidi.c localify 2019-12-01 08:23:09 +00:00
umodem_common.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
umodem.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
umodemvar.h clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
umodeswitch.c - USB_VENDOR_QUALCOMM -> USB_VENDOR_LG 2018-07-24 08:15:57 +00:00
ums.c localify 2019-12-01 08:23:09 +00:00
uplcom.c Fix USB_DEBUG build 2019-05-09 14:50:38 +00:00
urio.c localify 2019-12-01 08:23:09 +00:00
urio.h
usb_mem.c s/no free/no freelist entry/ in a debug message. 2019-08-28 07:11:19 +00:00
usb_mem.h
usb_quirks.c Remove extra white spaces. No functional change. 2019-05-23 04:44:49 +00:00
usb_quirks.h Workaround NBP PN533 USB toggle bit bugs 2018-11-15 02:35:23 +00:00
usb_subr.c Fix memory leaks. Was wondering where memory had gone after several hours 2019-10-03 05:20:31 +00:00
usb_verbose.c
usb_verbose.h
usb.c convert pairs of USBHIST_CALLED()+USBHIST_LOG*() into 2019-08-21 10:48:37 +00:00
usb.h avoid using old bsd types (u_int etc) so that this compiles with 2019-08-23 07:17:31 +00:00
usbcdc.h
usbdevices.config add mos(4) driver for Moschip MCS7730/MCS7830/MCS7832 usb ethernet. 2019-09-20 10:34:54 +00:00
usbdevs Add a few TP-Link "Archer" wlan devices 2019-10-06 17:22:29 +00:00
usbdevs_data.h Regen 2019-10-06 17:23:05 +00:00
usbdevs.h Regen 2019-10-06 17:23:05 +00:00
usbdi_util.c convert pairs of USBHIST_CALLED()+USBHIST_LOG*() into 2019-08-21 10:48:37 +00:00
usbdi_util.h Remove (mostly useless) usb_detach_{broadcast,wait} and replace with 2019-02-07 13:20:41 +00:00
usbdi.c add new usbd_do_request_len() that can allocate a larger than 2019-08-28 01:44:39 +00:00
usbdi.h add new usbd_do_request_len() that can allocate a larger than 2019-08-28 01:44:39 +00:00
usbdivar.h subdevlen is an array length, make it unsigned 2019-09-26 01:35:08 +00:00
usbhid.h Side-load dev/hid/hid.h to restore the previous visibility of macros 2018-07-15 18:36:51 +00:00
usbhist.h usbhist(9): 2019-08-22 00:24:07 +00:00
usbnet.c Don't assume mii is not null here. Some drivers like urndis don't use 2019-12-14 15:40:43 +00:00
usbnet.h document usbnet_private locking. minor knf. 2019-09-09 07:20:16 +00:00
usbroothub.c convert pairs of USBHIST_CALLED()+USBHIST_LOG*() into 2019-08-21 10:48:37 +00:00
usbroothub.h Some USB3 support from nick-nhusb 2017-11-28 07:36:08 +00:00
uscanner.c remove explicit 'extern struct cfdriver <my>_cd;' and use ioconf.h 2019-05-05 03:17:54 +00:00
uslsa.c clean up ucom parents some more: 2019-05-09 02:43:35 +00:00
uslsareg.h
usscanner.c localify 2019-12-01 08:23:09 +00:00
ustir.c minor adjustments, to avoid warnings on debug builds 2019-12-01 12:47:10 +00:00
ustirreg.h Purge an ancient email address, use dsainty@NetBSD.org instead 2019-09-22 07:28:35 +00:00
uthum.c Fix buffer overflows. sc_{o,f}len are controlled by the USB device. By 2020-01-01 09:03:00 +00:00
utoppy.c localify 2019-12-01 08:23:09 +00:00
utoppy.h
uts.c remove explicit 'extern struct cfdriver <my>_cd;' and use ioconf.h 2019-05-05 03:17:54 +00:00
uvideo.c localify 2019-12-01 08:23:09 +00:00
uvideoreg.h
uvisor.c s/transfered/transferred/ 2019-12-27 09:41:48 +00:00
uvscom.c localify 2019-12-01 08:23:09 +00:00
uyap_firmware.h
uyap.c localify 2019-12-01 08:23:09 +00:00
uyurex.c remove explicit 'extern struct cfdriver <my>_cd;' and use ioconf.h 2019-05-05 03:17:54 +00:00
vhci.c Not a bug strictly speaking, but compute the address only after the length 2019-11-17 11:28:48 +00:00
x1input_rdesc.h
xhci.c Acquire bus lock (if not polling) when changing xfer status, resetting 2019-12-29 09:17:51 +00:00
xhcireg.h HCSPARAMS2.SPR is bit 26, not 24 2019-06-19 15:10:17 +00:00
xhcivar.h Seperate xHCI and xhci(4) TRB structs so as to avoid some of them 2019-01-07 03:00:39 +00:00
xinput_rdesc.h