kernel/linux.git/drivers/usb/wusbcore/security.c, branch v4.11.5

usb: return correct errno code when krealloc fails

2016-11-29T16:36:43+00:00

In function wusb_dev_sec_add(), variable result takes the return value. Its value should be negative on failures. When function krealloc() is called, an earlier check of variable result guarantees that the value of result must not be less than "sizeof(*secd)", and result is not reassigned when krealloc() returns a NULL pointer. As a result, a positive value may be returned, which makes it impossible for the caller of wusb_dev_sec_add() to detect the error. This patch fixes the bug by assigning -ENOMEM to result when krealloc() returns NULL. Signed-off-by: Pan Bian Signed-off-by: Greg Kroah-Hartman

usb: wusbcore: security: don't print on ENOMEM

2016-08-30T17:17:39+00:00

All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman

wusb: replace memset by memzero_explicit

2014-12-03T00:15:02+00:00

Memset on a local variable may be removed when it is called just before the variable goes out of scope. Using memzero_explicit defeats this optimization. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ identifier x; type T; @@ { ... when any T x[...]; ... when any when exists - memset + memzero_explicit (x, -0, ...) ... when != x when strict } // This change was suggested by Daniel Borkmann Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman

usb: wusbcore: fix device disconnect on rekey timeout

2014-09-24T05:06:59+00:00

If three or more wireless devices are connected and two of them disconnect between 1-3 seconds apart, it can cause the HWA to disconnect the remaining devices due to failing to see a DN_Alive message from them. This happens because when the HWA detects that the first device is gone, it will attempt to rekey the remaining devices. If one of the devices is not responding because it has also been disconnected but not yet timed out, the synchronous rekey operation running on the wusbd workqueue can block for up to 5 seconds. This will prevent the KEEPALIVE timer from running and DN_Alive messages from being processed because they are processed by the same workqueue. This patch moves the rekey operation to a separate workqueue since it is the only wusb work item that needs to communicate directly with wireless devices. The rest of the WUSB work items either perform no device IO or communicate directly with the host controller and should not be blocked out by a non-responding wireless device. Signed-off-by: Thomas Pugliese Signed-off-by: Greg Kroah-Hartman

USB: wusbcore: fix up line break coding style issues in security.c

2014-01-08T00:19:30+00:00

Signed-off-by: Rahul Bedarkar Signed-off-by: Greg Kroah-Hartman

USB: wusbcore: correct spelling mistakes in comments and error string

2014-01-08T00:17:41+00:00

Signed-off-by: Rahul Bedarkar Acked-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman

Merge branch 3.13-rc4 into usb-next

2013-12-16T16:46:03+00:00

usb: wusbcore: use USB_CTRL_SET_TIMEOUT and USB_CTRL_GET_TIMEOUT

2013-12-09T21:28:48+00:00

Use USB_CTRL_SET_TIMEOUT and USB_CTRL_GET_TIMEOUT for USB control messages instead of an arbitrary 1s timeout value. This is particularly useful for WUSB since in the worst case RF scanario, a WUSB device can be unresponsive for up to 4s and still be connected. Signed-off-by: Thomas Pugliese Signed-off-by: Greg Kroah-Hartman

usb: wusbcore: fix deadlock in wusbhc_gtk_rekey

2013-12-02T23:21:04+00:00

When multiple wireless USB devices are connected and one of the devices disconnects, the host will distribute a new group key to the remaining devicese using wusbhc_gtk_rekey. wusbhc_gtk_rekey takes the wusbhc->mutex and holds it while it submits a URB to set the new key. This causes a deadlock in wa_urb_enqueue when it calls a device lookup helper function that takes the same lock. This patch changes wusbhc_gtk_rekey to submit a work item to set the GTK so that the URB is submitted without holding wusbhc->mutex. Signed-off-by: Thomas Pugliese Signed-off-by: Greg Kroah-Hartman

wusb: Fix potential memory leak in wusb_dev_sec_add()

2012-08-10T19:06:38+00:00

Do not leak memory by updating pointer with potentially NULL realloc return value. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Greg Kroah-Hartman