kernel/linux.git/drivers/usb/core/message.c, branch v4.14.85

usb: Avoid use-after-free by flushing endpoints early in usb_set_interface()

2018-09-26T06:38:07+00:00

commit f9a5b4f58b280c1d26255376713c132f93837621 upstream. The steps taken by usb core to set a new interface is very different from what is done on the xHC host side. xHC hardware will do everything in one go. One command is used to set up new endpoints, free old endpoints, check bandwidth, and run the new endpoints. All this is done by xHC when usb core asks the hcd to check for available bandwidth. At this point usb core has not yet flushed the old endpoints, which will cause use-after-free issues in xhci driver as queued URBs are cancelled on a re-allocated endpoint. To resolve this add a call to usb_disable_interface() which will flush the endpoints before calling usb_hcd_alloc_bandwidth() Additional checks in xhci driver will also be implemented to gracefully handle stale URB cancel on freed and re-allocated endpoints Cc: Reported-by: Sudip Mukherjee Signed-off-by: Mathias Nyman Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman

usb: quirks: add control message delay for 1b1c:1b20

2018-03-19T07:42:46+00:00

commit cb88a0588717ba6c756cb5972d75766b273a6817 upstream. Corsair Strafe RGB keyboard does not respond to usb control messages sometimes and hence generates timeouts. Commit de3af5bf259d ("usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard") tried to fix those timeouts by adding USB_QUIRK_DELAY_INIT. Unfortunately, even with this quirk timeouts of usb_control_msg() can still be seen, but with a lower frequency (approx. 1 out of 15): [ 29.103520] usb 1-8: string descriptor 0 read error: -110 [ 34.363097] usb 1-8: can't set config #1, error -110 Adding further delays to different locations where usb control messages are issued just moves the timeouts to other locations, e.g.: [ 35.400533] usbhid 1-8:1.0: can't add hid device: -110 [ 35.401014] usbhid: probe of 1-8:1.0 failed with error -110 The only way to reliably avoid those issues is having a pause after each usb control message. In approx. 200 boot cycles no more timeouts were seen. Addionaly, keep USB_QUIRK_DELAY_INIT as it turned out to be necessary to have the delay in hub_port_connect() after hub_port_init(). The overall boot time seems not to be influenced by these additional delays, even on fast machines and lightweight distributions. Fixes: de3af5bf259d ("usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard") Cc: stable@vger.kernel.org Signed-off-by: Danilo Krummrich Signed-off-by: Greg Kroah-Hartman

USB: core: harden cdc_parse_cdc_header

2017-09-21T15:01:38+00:00

Andrey Konovalov reported a possible out-of-bounds problem for the cdc_parse_cdc_header function. He writes: It looks like cdc_parse_cdc_header() doesn't validate buflen before accessing buffer[1], buffer[2] and so on. The only check present is while (buflen > 0). So fix this issue up by properly validating the buffer length matches what the descriptor says it is. Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Cc: stable Signed-off-by: Greg Kroah-Hartman

usb: get rid of some ReST doc build errors

2017-04-11T20:40:48+00:00

We need an space before a numbered list to avoid those warnings: ./drivers/usb/core/message.c:478: ERROR: Unexpected indentation. ./drivers/usb/core/message.c:479: WARNING: Block quote ends without a blank line; unexpected unindent. ./include/linux/usb/composite.h:455: ERROR: Unexpected indentation. ./include/linux/usb/composite.h:456: WARNING: Block quote ends without a blank line; unexpected unindent. Signed-off-by: Mauro Carvalho Chehab Acked-by: Greg Kroah-Hartman Signed-off-by: Jonathan Corbet

usb: core: update comments for send message functions

2017-01-19T09:34:40+00:00

The commonly use of bottom halves are tasklet and workqueue. The big difference between tasklet and workqueue is that the tasklet runs in an interrupt context and the workqueue runs in a process context, which means it can sleep if need be. The comment for usb_control/interrupt/bulk_msg() functions note that do not use this function within an interrupt context, like a 'bottom half' handler. With this comment, it makes confuse about usage of these functions. To more clarify, remove 'bottom half' comment. Signed-off-by: Jaejoong Kim Signed-off-by: Greg Kroah-Hartman

USB: core: add missing license information to some files

2016-10-29T16:51:56+00:00

Some of the USB core files were missing explicit license information. As all files in the kernel tree are implicitly licensed under the GPLv2-only, be explicit in case someone get confused looking at individual files by using the SPDX nomenclature. Signed-off-by: Greg Kroah-Hartman

usb: core: setup dma_pfn_offset for USB devices and, interfaces

2016-09-13T15:25:35+00:00

If dma_pfn_offset is not inherited correctly from the host controller, it might result in sub-optimal configuration as bounce buffer limit might be set to less than optimal level. Consider the mass storage device case. USB storage driver creates a scsi host for the mass storage interface in drivers/usb/storage/usb.c The scsi host parent device is nothing but the the USB interface device. Now, __scsi_init_queue() calls scsi_calculate_bounce_limit() to find out and set the block layer bounce limit. scsi_calculate_bounce_limit() uses dma_max_pfn(host_dev) to get the bounce_limit. host_dev is nothing but the device representing the mass storage interface. If that device doesn't have the right dma_pfn_offset, then dma_max_pfn() is messed up and the bounce buffer limit is wrong. e.g. On Keystone 2 systems, dma_max_pfn() is 0x87FFFF and dma_mask_pfn is 0xFFFFF. Consider a mass storage use case: Without this patch, usb scsi host device (usb-storage) will get a dma_pfn_offset of 0 resulting in a dma_max_pfn() of 0xFFFFF within the scsi layer (scsi_calculate_bounce_limit()). This will result in bounce buffers being unnecessarily used. Hint: On 32-bit ARM platforms dma_max_pfn() = dma_mask_pfn + dma_pfn_offset Signed-off-by: Roger Quadros Acked-by: Arnd Bergmann Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman

usb: core: message: don't print on ENOMEM

2016-08-30T17:17:36+00:00

All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman

usbnet: move the CDC parser into USB core

2016-07-18T15:46:57+00:00

The dependencies were impossible to handle preventing drivers for CDC devices not which are not network drivers from using the common parser. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman

drivers: usb: core: Minimize irq disabling in usb_sg_cancel()

2016-04-26T22:21:41+00:00

Restructure usb_sg_cancel() so we don't have to disable interrupts while cancelling the URBs. Suggested-by: Alan Stern Signed-off-by: David Mosberger Signed-off-by: Greg Kroah-Hartman