kernel/linux.git/drivers/usb/usbip, branch v3.18.62

usb: usbip: set buffer pointers to NULL after free

2017-07-15T08:14:39+00:00

commit b3b51417d0af63fb9a06662dc292200aed9ea53f upstream. The usbip stack dynamically allocates the transfer_buffer and setup_packet of each urb that got generated by the tcp to usb stub code. As these pointers are always used only once we will set them to NULL after use. This is done likewise to the free_urb code in vudc_dev.c. This patch fixes double kfree situations where the usbip remote side added the URB_FREE_BUFFER. Signed-off-by: Michael Grzeschik Acked-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman

USB: usbip: fix potential out-of-bounds write

2016-07-12T12:47:50+00:00

[ Upstream commit b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb ] Fix potential out-of-bounds write to urb->transfer_buffer usbip handles network communication directly in the kernel. When receiving a packet from its peer, usbip code parses headers according to protocol. As part of this parsing urb->actual_length is filled. Since the input for urb->actual_length comes from the network, it should be treated as untrusted. Any entity controlling the network may put any value in the input and the preallocated urb->transfer_buffer may not be large enough to hold the data. Thus, the malicious entity is able to write arbitrary data to kernel memory. Signed-off-by: Ignat Korchagin Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

usbip: remove struct usb_device_id table

2014-08-25T17:40:58+00:00

This was used back when usbip-host was an interface device driver; after the conversion to device driver, the table remained unused. Remove it in order to stop receiving a warning about it. Signed-off-by: Valentina Manea Signed-off-by: Greg Kroah-Hartman

usbip: move usbip kernel code out of staging

2014-08-25T17:40:06+00:00

At this point, USB/IP kernel code is fully functional and can be moved out of staging. Signed-off-by: Valentina Manea Signed-off-by: Greg Kroah-Hartman