kernel/linux.git/drivers/usb/serial/quatech2.c, branch v5.10.264

USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()

2025-02-01T17:22:33+00:00

commit 575a5adf48b06a2980c9eeffedf699ed5534fade upstream. This patch addresses a null-ptr-deref in qt2_process_read_urb() due to an incorrect bounds check in the following: if (newport > serial->num_ports) { dev_err(&port->dev, "%s - port change to invalid port: %i\n", __func__, newport); break; } The condition doesn't account for the valid range of the serial->port buffer, which is from 0 to serial->num_ports - 1. When newport is equal to serial->num_ports, the assignment of "port" in the following code is out-of-bounds and NULL: serial_priv->current_port = newport; port = serial->port[serial_priv->current_port]; The fix checks if newport is greater than or equal to serial->num_ports indicating it is out-of-bounds. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=506479ebf12fe435d01a Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver") Cc: # 3.5 Signed-off-by: Qasim Ijaz Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

USB: serial: quatech2: fix control-request directions

2021-06-16T10:01:42+00:00

commit eb8dbe80326c3d44c1e38ee4f40e0d8d3e06f2d0 upstream. The direction of the pipe argument must match the request-type direction bit or control requests may fail depending on the host-controller-driver implementation. Fix the three requests which erroneously used usb_rcvctrlpipe(). Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver") Cc: stable@vger.kernel.org # 3.5 Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

USB: serial: quatech2: drop two stub functions

2020-07-02T08:38:44+00:00

Drop two unused stub functions which only served as documentation. This also avoids a W=1 (-Wunused-but-set-variable) warning. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold

USB: serial: quatech2: handle unbound ports

2020-01-17T15:22:59+00:00

Check for NULL port data in the modem- and line-status handlers to avoid dereferencing a NULL pointer in the unlikely case where a port device isn't bound to a driver (e.g. after an allocation failure on port probe). Note that the other (stubbed) event handlers qt2_process_xmit_empty() and qt2_process_flush() would need similar sanity checks in case they are ever implemented. Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver") Cc: stable # 3.5 Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold

USB: serial: quatech2: remove set but not used variable 'port_priv'

2018-11-12T09:08:10+00:00

Fixes gcc '-Wunused-but-set-variable' warning: drivers/usb/serial/quatech2.c: In function 'qt2_process_read_urb': drivers/usb/serial/quatech2.c:503:27: warning: variable 'port_priv' set but not used [-Wunused-but-set-variable] It not used any more after commit 2be818a116b2 ('Revert "USB: quatech2: only write to the tty if the port is open."') Signed-off-by: YueHaibing Signed-off-by: Johan Hovold

quatech2: switch to ->get_serial()

2018-10-13T04:50:40+00:00

Reviewed-by: Johan Hovold Signed-off-by: Al Viro

USB: serial: quatech2: use irqsave() in USB's complete callback

2018-06-26T12:52:15+00:00

The USB completion callback does not disable interrupts while acquiring the lock. We want to remove the local_irq_disable() invocation from __usb_hcd_giveback_urb() and therefore it is required for the callback handler to disable the interrupts while acquiring the lock. The callback may be invoked either in IRQ or BH context depending on the USB host controller. Use the _irqsave() variant of the locking primitives. Signed-off-by: John Ogness Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Johan Hovold

USB: serial: cast sizeof() to int when comparing with error code

2018-06-25T08:34:31+00:00

Negative error code will be larger than sizeof(). Note that none of these bugs prevent errors from being detected, even if the ir-usb one would cause a less precise debug message to printed. Signed-off-by: Chengguang Xu [ johan: add comment about implications ] Signed-off-by: Johan Hovold

USB: serial: fix module-license macros

2017-11-04T10:58:00+00:00

Several GPL-2.0 drivers used "GPL" rather than "GPL v2" in their MODULE_LICENSE macros; fix the macros to match the licenses. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

USB: serial: Remove redundant license text

2017-11-04T10:55:38+00:00

Now that the SPDX tag is in all USB files, that identifies the license in a specific and legally-defined manner. So the extra GPL text wording can be removed as it is no longer needed at all. This is done on a quest to remove the 700+ different ways that files in the kernel describe the GPL license text. And there's unneeded stuff like the address (sometimes incorrect) for the FSF which is never needed. No copyright headers or other non-license-description text was removed. Signed-off-by: Greg Kroah-Hartman Acked-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman