BMC/Intel-BMC/linux.git/drivers/usb, branch dev-5.14-intel

USB: gadget: fix illegal array access in binding with UDC

2021-10-19T22:10:34+00:00

FuzzUSB (a variant of syzkaller) found an illegal array access using an incorrect index while binding a gadget with UDC. Reference: https://www.spinics.net/lists/linux-usb/msg194331.html This bug occurs when a size variable used for a buffer is misused to access its strcpy-ed buffer. Given a buffer along with its size variable (taken from user input), from which, a new buffer is created using kstrdup(). Due to the original buffer containing 0 value in the middle, the size of the kstrdup-ed buffer becomes smaller than that of the original. So accessing the kstrdup-ed buffer with the same size variable triggers memory access violation. The fix makes sure no zero value in the buffer, by comparing the strlen() of the orignal buffer with the size variable, so that the access to the kstrdup-ed buffer is safe. BUG: KASAN: slab-out-of-bounds in gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266 Read of size 1 at addr ffff88806a55dd7e by task syz-executor.0/17208 CPU: 2 PID: 17208 Comm: syz-executor.0 Not tainted 5.6.8 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x131/0x1b0 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132 gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266 flush_write_buffer fs/configfs/file.c:251 [inline] configfs_write_file+0x2f1/0x4c0 fs/configfs/file.c:283 __vfs_write+0x85/0x110 fs/read_write.c:494 vfs_write+0x1cd/0x510 fs/read_write.c:558 ksys_write+0x18a/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:620 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Signed-off-by: Kyungtae Kim Reported-and-tested-by: Kyungtae Kim Cc: Felipe Balbi Cc: stable Link: https://lore.kernel.org/r/20200510054326.GA19198@pizza01 Signed-off-by: Greg Kroah-Hartman

Add IO statistics to USB Mass storage gadget

2021-10-19T22:10:32+00:00

Introduces new attribute to Mass Storage Gadget ConfigFS : stats. It's read-only attribute which contains statistics of read/write operations based on LUN transaction counters (IO number and bytes transferred). Goal is to provide a way to observe whether simulated device is actually used by host. Statistics on hosted file / nbd level are not always viable due to page cache having severe impact on actual IO statistics. This attribute should provide information about host IO on USB Gadget as close to endpoint as possible. Attribute is tied completely to configFS implementation and it's lifecycle is managed by Kernel and user. Driver implements a handler which populates output buffer on read. Tests performed: - mounted USB Mass Storage gadget, new attribute showed up in gadget tree - attribute was monitored for changes during IO performed on host machine - removed device, attribute (along with other device attributes) was gone Signed-off-by: Adrian Ambrożewicz

Suppress excessive HID gadget error logs

2021-10-19T22:10:31+00:00

HID events can be sent even when the host disconnects the HID device according to the current graphic mode. For an example, if KVM mouse events are sent when the host is in text mode, queueing of end point messages will be dropped with this message: configfs-gadget gadget: usb_ep_queue error on int endpoint -108 This case is very usual case in BMC since BMC can control power status of the host, so this commit suppress the error printing outs with making HID gadget driver drop events quietly in the case. This should be a downstream only customization. Do not upstream it. Signed-off-by: Jae Hyun Yoo

Merge tag 'v5.14.11' into dev-5.14

2021-10-11T05:22:51+00:00

This is the 5.14.11 stable release Signed-off-by: Joel Stanley

usb: ehci: Handshake CMD_RUN instead of STS_HALT for Aspeed

2021-10-11T05:13:56+00:00

For Aspeed, HCHalted status depends on not only Run/Stop but also ASS/PSS status. Handshake CMD_RUN on startup instead. OpenBMC-Staging-Count: 1 Signed-off-by: Neal Liu Acked-by: Alan Stern Reviewed-by: Tao Ren Tested-by: Tao Ren Reviewed-by: Joel Stanley Fixes: 280a9045bb18 ("ehci: fix EHCI host controller initialization sequence") Link: https://lore.kernel.org/r/20210910073619.26095-1-neal_liu@aspeedtech.com Signed-off-by: Joel Stanley

usb: dwc2: check return value after calling platform_get_resource()

2021-10-09T13:02:39+00:00

[ Upstream commit 856e6e8e0f9300befa87dde09edb578555c99a82 ] It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20210831084236.1359677-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

usb: gadget: f_uac2: Populate SS descriptors' wBytesPerInterval

2021-09-30T08:13:08+00:00

commit f0e8a206a2a53a919e1709c654cb65d519f7befb upstream. For Isochronous endpoints, the SS companion descriptor's wBytesPerInterval field is required to reserve bus time in order to transmit the required payload during the service interval. If left at 0, the UAC2 function is unable to transact data on its playback or capture endpoints in SuperSpeed mode. Since f_uac2 currently does not support any bursting this value can be exactly equal to the calculated wMaxPacketSize. Tested with Windows 10 as a host. Fixes: f8cb3d556be3 ("usb: f_uac2: adds support for SS and SSP") Cc: stable Signed-off-by: Jack Pham Link: https://lore.kernel.org/r/20210909174811.12534-3-jackp@codeaurora.org [jackp: Backport to 5.14 with minor conflict resolution] Signed-off-by: Jack Pham Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_uac2: Add missing companion descriptor for feedback EP

2021-09-30T08:13:08+00:00

commit 595091a1426a3b2625dad322f69fe569dc9d8943 upstream. The f_uac2 function fails to enumerate when connected in SuperSpeed due to the feedback endpoint missing the companion descriptor. Add a new ss_epin_fback_desc_comp descriptor and append it behind the ss_epin_fback_desc both in the static definition of the ss_audio_desc structure as well as its dynamic construction in setup_headers(). Fixes: 24f779dac8f3 ("usb: gadget: f_uac2/u_audio: add feedback endpoint support") Cc: stable Signed-off-by: Jack Pham Link: https://lore.kernel.org/r/20210909174811.12534-2-jackp@codeaurora.org [jackp: Backport to 5.14 with minor conflict resolution] Signed-off-by: Jack Pham Signed-off-by: Greg Kroah-Hartman

USB: serial: cp210x: fix dropped characters with CP2102

2021-09-30T08:13:07+00:00

commit c32dfec6c1c36bbbcd5d33e949d99aeb215877ec upstream. Some CP2102 do not support event-insertion mode but return no error when attempting to enable it. This means that any event escape characters in the input stream will not be escaped by the device and consequently regular data may be interpreted as escape sequences and be removed from the stream by the driver. The reporter's device has batch number DCL00X etched into it and as discovered by the SHA2017 Badge team, counterfeit devices with that marking can be detected by sending malformed vendor requests. [1][2] Tests confirm that the possibly counterfeit CP2102 returns a single byte in response to a malformed two-byte part-number request, while an original CP2102 returns two bytes. Assume that every CP2102 that behaves this way also does not support event-insertion mode (e.g. cannot report parity errors). [1] https://mobile.twitter.com/sha2017badge/status/1167902087289532418 [2] https://hackaday.com/2017/08/14/hands-on-with-the-shacamp-2017-badge/#comment-3903376 Reported-by: Malte Di Donato Tested-by: Malte Di Donato Fixes: a7207e9835a4 ("USB: serial: cp210x: add support for line-status events") Cc: stable@vger.kernel.org # 5.9 Link: https://lore.kernel.org/r/20210922113100.20888-1-johan@kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

xhci: Set HCD flag to defer primary roothub registration

2021-09-30T08:12:56+00:00

commit b7a0a792f864583207c593b50fd1b752ed89f4c1 upstream. Set "HCD_FLAG_DEFER_RH_REGISTER" to hcd->flags in xhci_run() to defer registering primary roothub in usb_add_hcd(). This will make sure both primary roothub and secondary roothub will be registered along with the second HCD. This is required for cold plugged USB devices to be detected in certain PCIe USB cards (like Inateck USB card connected to AM64 EVM or J7200 EVM). CC: stable@vger.kernel.org # 5.4+ Suggested-by: Mathias Nyman Tested-by: Chris Chiu Signed-off-by: Kishon Vijay Abraham I Link: https://lore.kernel.org/r/20210909064200.16216-3-kishon@ti.com Signed-off-by: Greg Kroah-Hartman