kernel/linux.git/drivers/usb/wusbcore, branch v4.11.5

USB: wusbcore: fix NULL-deref at probe

2017-03-14T09:07:30+00:00

Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints. This specifically fixes the NULL-pointer dereference when probing HWA HC devices. Fixes: df3654236e31 ("wusb: add the Wire Adapter (WA) core") Cc: stable # 2.6.28 Cc: Inaky Perez-Gonzalez Cc: David Vrabel Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

wusbcore: Fix one more crypto-on-the-stack bug

2017-01-10T16:03:42+00:00

The driver put a constant buffer of all zeros on the stack and pointed a scatterlist entry at it. This doesn't work with virtual stacks. Use ZERO_PAGE instead. Cc: stable@vger.kernel.org # 4.9 only Reported-by: Eric Biggers Signed-off-by: Andy Lutomirski Signed-off-by: Greg Kroah-Hartman

usb: fix improper return value when kzalloc fails

2016-11-29T16:36:43+00:00

The comment says function wa_nep_queue() should return 0 if ok, and <0 errno code on error. However, its implementation always returns 0, even if the call to kzalloc() fails. As a result, the return value may be inconsistent with the execution status, which may mislead the callers. This patch fixes the bug, returning -ENOMEM when the call to kzalloc() fails. Signed-off-by: Pan Bian Signed-off-by: Greg Kroah-Hartman

usb: return correct errno on failures

2016-11-29T16:36:43+00:00

In function __wa_xfer_setup_segs(), variable result takes the return value. Its value should be a negative errno on failures. Because result may be reassigned in a loop, and its value is guaranteed to be not less than 0 during the following repeats of the loop. So when the call to kmalloc() or usb_alloc_urb() fails in the loop, the value of variable result may be 0 (indicates no error), which is inconsistent with the execution status. This patch fixes the bug, initializing variable result with -ENOMEM in the loop. Signed-off-by: Pan Bian Signed-off-by: Greg Kroah-Hartman

usb: return correct errno code when krealloc fails

2016-11-29T16:36:43+00:00

In function wusb_dev_sec_add(), variable result takes the return value. Its value should be negative on failures. When function krealloc() is called, an earlier check of variable result guarantees that the value of result must not be less than "sizeof(*secd)", and result is not reassigned when krealloc() returns a NULL pointer. As a result, a positive value may be returned, which makes it impossible for the caller of wusb_dev_sec_add() to detect the error. This patch fixes the bug by assigning -ENOMEM to result when krealloc() returns NULL. Signed-off-by: Pan Bian Signed-off-by: Greg Kroah-Hartman

wusbcore: wusbhc: use permission-specific DEVICE_ATTR variants

2016-11-07T09:19:49+00:00

Use DEVICE_ATTR_RW for read-write attributes. This simplifies the source code, improves readbility, and reduces the chance of inconsistencies. The semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @rw@ declarer name DEVICE_ATTR; identifier x,x_show,x_store; @@ DEVICE_ATTR(x, \(0644\|S_IRUGO|S_IWUSR\), x_show, x_store); @script:ocaml@ x << rw.x; x_show << rw.x_show; x_store << rw.x_store; @@ if not (x^"_show" = x_show && x^"_store" = x_store) then Coccilib.include_match false @@ declarer name DEVICE_ATTR_RW; identifier rw.x,rw.x_show,rw.x_store; @@ - DEVICE_ATTR(x, \(0644\|S_IRUGO|S_IWUSR\), x_show, x_store); + DEVICE_ATTR_RW(x); // Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman

wusbcore: dev-sysfs: use permission-specific DEVICE_ATTR variants

2016-11-07T09:19:49+00:00

Use DEVICE_ATTR_WO for write ony attributes and DEVICE_ATTR_RO for read only attributes. This simplifies the source code, improves readbility, and reduces the chance of inconsistencies. The semantic patch for the RO case is as follows: (http://coccinelle.lip6.fr/) // @ro@ declarer name DEVICE_ATTR; identifier x,x_show; @@ DEVICE_ATTR(x, \(0444\|S_IRUGO\), x_show, NULL); @script:ocaml@ x << ro.x; x_show << ro.x_show; @@ if not (x^"_show" = x_show) then Coccilib.include_match false @@ declarer name DEVICE_ATTR_RO; identifier ro.x,ro.x_show; @@ - DEVICE_ATTR(x, \(0444\|S_IRUGO\), x_show, NULL); + DEVICE_ATTR_RO(x); // Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman

wusb: fix error return code in wusb_prf()

2016-10-19T13:28:29+00:00

Fix to return error code -ENOMEM from the kmalloc() error handling case instead of 0, as done elsewhere in this function. Fixes: a19b882c07a6 ("wusb: Stop using the stack for sg crypto scratch space") Signed-off-by: Wei Yongjun Signed-off-by: Greg Kroah-Hartman

wusb: Stop using the stack for sg crypto scratch space

2016-10-17T09:50:43+00:00

Pointing an sg list at the stack is verboten and, with CONFIG_VMAP_STACK=y, will malfunction. Use kmalloc for the wusb crypto stack space instead. Untested -- I'm not entirely convinced that this hardware exists in the wild. Signed-off-by: Andy Lutomirski Signed-off-by: Greg Kroah-Hartman

USB: wusbcore: add in missing white space in error message text

2016-09-13T15:24:24+00:00

A dev_err message spans two lines and the literal string is missing a white space between words. Add the white space and reformat the message to not span multiple lines. Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman