kernel/linux.git/drivers/usb/core/devio.c, branch v3.0.35

USB: Remove races in devio.c

2012-06-01T07:12:57+00:00

commit 4e09dcf20f7b5358615514c2ec8584b248ab8874 upstream. There exist races in devio.c, below is one case, and there are similar races in destroy_async() and proc_unlinkurb(). Remove these races. cancel_bulk_urbs() async_completed() ------------------- ----------------------- spin_unlock(&ps->lock); list_move_tail(&as->asynclist, &ps->async_completed); wake_up(&ps->wait); Lead to free_async() be triggered, then urb and 'as' will be freed. usb_unlink_urb(as->urb); ===> refer to the freed 'as' Signed-off-by: Huajun Li Cc: Alan Stern Cc: Oncaphillis Signed-off-by: Greg Kroah-Hartman

USB: pid_ns: ensure pid is not freed during kill_pid_info_as_uid

2011-11-11T17:35:37+00:00

commit aec01c5895051849ed842dc5b8794017a7751f28 upstream. Alan Stern points out that after spin_unlock(&ps->lock) there is no guarantee that ps->pid won't be freed. Since kill_pid_info_as_uid() is called after the spin_unlock(), the pid passed to it must be pinned. Reported-by: Alan Stern Signed-off-by: Serge Hallyn Signed-off-by: Greg Kroah-Hartman

usb/core/devio.c: Check for printer class specific request

2011-11-11T17:35:36+00:00

commit 393cbb5151ecda9f9e14e3082d048dd27a1ff9f6 upstream. In the usb printer class specific request get_device_id the value of wIndex is (interface << 8 | altsetting) instead of just interface. This enables the detection of some printers with libusb. Acked-by: Alan Stern Signed-off-by: Matthias Dellweg <2500@gmx.de> Signed-off-by: Greg Kroah-Hartman

USB: Do not pass negative length to snoop_urb()

2011-03-23T20:14:16+00:00

When `echo Y > /sys/module/usbcore/parameters/usbfs_snoop` and usb_control_msg() returns error, a lot of kernel memory is dumped to dmesg until unhandled kernel paging request occurs. Signed-off-by: Michal Sojka Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman

BKL: remove extraneous #include

2010-11-17T16:59:32+00:00

The big kernel lock has been removed from all these files at some point, leaving only the #include. Remove this too as a cleanup. Signed-off-by: Arnd Bergmann Signed-off-by: Linus Torvalds

usb: core: fix information leak to userland

2010-11-11T15:14:07+00:00

Structure usbdevfs_connectinfo is copied to userland with padding byted after "slow" field uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Cc: stable Signed-off-by: Greg Kroah-Hartman

USB-BKL: Convert usb_driver ioctl to unlocked_ioctl

2010-08-10T21:35:35+00:00

And audit all the users. None needed the BKL. That was easy because there was only very few around. Tested with allmodconfig build on x86-64 Signed-off-by: Andi Kleen Cc: Arnd Bergmann From: Andi Kleen

USB: make hcd.h public (drivers dependency)

2010-05-20T20:21:30+00:00

The usbcore headers: hcd.h and hub.h are shared between usbcore, HCDs and a couple of other drivers (e.g. USBIP modules). So, it makes sense to move them into a more public location and to cleanup dependency of those modules on kernel internal headers. This patch moves hcd.h from drivers/usb/core into include/linux/usb/ Signed-of-by: Eric Lescouet Cc: Alan Stern Signed-off-by: Greg Kroah-Hartman

USB: fix usbfs regression

2010-03-19T14:24:02+00:00

This patch (as1352) fixes a bug in the way isochronous input data is returned to userspace for usbfs transfers. The entire buffer must be copied, not just the first actual_length bytes, because the individual packets will be discontiguous if any of them are short. Reported-by: Markus Rechberger Signed-off-by: Alan Stern CC: stable Signed-off-by: Greg Kroah-Hartman

USB: usbfs_snoop: add data logging back in

2010-03-02T22:54:37+00:00

Uses the new snoop function from commit 4c6e8971cbe0148085, but includes the buffer data where appropriate, as before. Signed-off-by: Chris Frey Signed-off-by: Greg Kroah-Hartman