airbus-seclab / usbq_core

USB man in the middle linux kernel driver
19 stars 7 forks source link

kernel 5.12 unable to send to userland #7

Open bm16ton opened 3 years ago

bm16ton commented 3 years ago

Hi all. So I grabbed the kernel module source and since set_fs get_fs are gone now I added the force_uaccess changes, and it seemed silly to recompile the kernel for the ip address so I simply made it a kernel module parameter. Ive never used this sofware before but it seems to work fine up until its first attempt to send to userland. Im thinking the force_uaccess_begin/end hack is the problem. Its also possible im just doing something wrong, relevant part of logs;

[254] DRIVER driver_probe(1168): SPEED: 2 [ 15] DRIVER build_init_pkt(1144): Init packet [ 15] DRIVER build_init_pkt(1144): msg:0000000068b477c2 asize:123 data_size:123 type:2 management_type:1 [ 15] DRIVER build_init_pkt(1144): 02 00 00 00 12 01 00 02 ef 02 01 40 83 04 4b 37 [ 15] DRIVER build_init_pkt(1144): 00 01 01 02 03 01 09 02 80 00 04 01 00 80 96 09 [ 15] DRIVER build_init_pkt(1144): 04 00 00 03 ff ff ff 04 07 05 81 02 40 00 00 07 [ 15] DRIVER build_init_pkt(1144): 05 01 02 40 00 00 07 05 82 02 20 00 00 09 04 01 [ 15] DRIVER build_init_pkt(1144): 00 02 08 06 50 05 07 05 83 02 40 00 00 07 05 03 [ 15] DRIVER build_init_pkt(1144): 02 40 00 00 09 04 02 00 01 02 02 01 06 07 05 84 [ 15] DRIVER build_init_pkt(1144): 03 08 00 ff 09 04 03 00 02 0a 00 00 07 07 05 05 [ 15] DRIVER build_init_pkt(1144): 02 10 00 00 07 05 85 02 10 00 00 [ 15] DRIVER ep_driver_send_userland(0633): UDP -- SEND epid:[ep:0 type:CTRL dir:IN] [ 15] DRIVER ep_driver_send_userland(0633): msg:0000000068b477c2 asize:123 data_size:123 type:2 management_type:1 [ 15] DRIVER ep_driver_send_userland(0633): 02 00 00 00 12 01 00 02 ef 02 01 40 83 04 4b 37 [ 15] DRIVER ep_driver_send_userland(0633): 00 01 01 02 03 01 09 02 80 00 04 01 00 80 96 09 [ 15] DRIVER ep_driver_send_userland(0633): 04 00 00 03 ff ff ff 04 07 05 81 02 40 00 00 07 [ 15] DRIVER ep_driver_send_userland(0633): 05 01 02 40 00 00 07 05 82 02 20 00 00 09 04 01 [ 15] DRIVER ep_driver_send_userland(0633): 00 02 08 06 50 05 07 05 83 02 40 00 00 07 05 03 [ 15] DRIVER ep_driver_send_userland(0633): 02 40 00 00 09 04 02 00 01 02 02 01 06 07 05 84 [ 15] DRIVER ep_driver_send_userland(0633): 03 08 00 ff 09 04 03 00 02 0a 00 00 07 07 05 05 [ 15] DRIVER ep_driver_send_userland(0633): 02 10 00 00 07 05 85 02 10 00 00 [ 15] DRIVER udp_send(0170): UDP sending buf:0000000048fa5f1c sz_sent:0 still:139 [ 64] DRIVER udp_send(0173): Error during UDP send : -14 [ 64] DRIVER ep_driver_send_userland(0636): Unable to send userland [-11] epid:[ep:0 type:CTRL dir:IN] [ 64] DRIVER driver_probe(1197): Unable to send to userland init pkt [-11] ubq_driver: probe of 1-1:1.0 failed with error -11 usb-storage 1-1:1.1: USB Mass Storage device detected scsi host1: usb-storage 1-1:1.1 [254] DRIVER driver_probe(1168): SPEED: 2 [254] DRIVER driver_probe(1168): SPEED: 2 scsi 1:0:0:0: Direct-Access MBED microcontroller 1.0 PQ: 0 ANSI: 2 sd 1:0:0:0: Attached scsi generic sg9 type 0 sd 1:0:0:0: [sdg] 12360 512-byte logical blocks: (6.33 MB/6.04 MiB) sd 1:0:0:0: [sdg] Write Protect is off sd 1:0:0:0: [sdg] Mode Sense: 03 00 00 00 sd 1:0:0:0: [sdg] No Caching mode page found sd 1:0:0:0: [sdg] Assuming drive cache: write through sd 1:0:0:0: [sdg] Attached SCSI removable disk [ 16] GADGET ubq_gadget_exit(1332): GADGET_EXIT OK [254] DRIVER ubq_disable_device(1290): DISABLE DEVICE [254] DRIVER free_driver_endpoint(0256): Free driver endpoint ep:[ep:0 type:CTRL dir:OUT] [254] DRIVER free_driver_endpoint(0256): Free driver endpoint ep:[ep:0 type:CTRL dir:IN] usbcore: deregistering interface driver ubq_driver [ 16] DRIVER driver_disconnect(1250): DRIVER DISCONNECT [ 15] DRIVER udp_send(0170): UDP sending buf:0000000006fc0560 sz_sent:0 still:16 [ 64] DRIVER udp_send(0173): Error during UDP send : -14 [ 64] DRIVER driver_disconnect(1263): Unable to send to userland [-11] [ 16] DRIVER ubq_driver_exit(1333): DRIVER_EXIT OK usb 1-1: USB disconnect, device number 14

Hopefully someone has come accross this already. I integrated this into my kernel source here; https://github.com/bm16ton/yoga-c630-linux-kernel/ When I have time ill narrow down the cause a lil better.

UPDATE: I tried kernel 5.10 and it was able to send so will try 5.11 at some point and narrow dwn when the issue was introdued