kernel/linux.git/drivers/usb/wusbcore, branch v4.4.171

usb: wusbcore: security: cast sizeof to int for comparison

2018-10-10T06:52:05+00:00

[ Upstream commit d3ac5598c5010a8999978ebbcca3b1c6188ca36b ] Comparing an int to a size, which is unsigned, causes the int to become unsigned, giving the wrong result. usb_get_descriptor can return a negative error code. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ int x; expression e,e1; identifier f; @@ *x = f(...); ... when != x = e1 when != if (x < 0 || ...) { ... return ...; } *x < sizeof(e) // Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

USB: wusbcore: fix NULL-deref at probe

2017-03-30T07:35:17+00:00

commit 03ace948a4eb89d1cf51c06afdfc41ebca5fdb27 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints. This specifically fixes the NULL-pointer dereference when probing HWA HC devices. Fixes: df3654236e31 ("wusb: add the Wire Adapter (WA) core") Cc: Inaky Perez-Gonzalez Cc: David Vrabel Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

wusbcore: rh: use USB_DT_HUB

2015-04-03T17:03:15+00:00

Fix using the bare number to set the 'bDescriptorType' field of the Hub Descriptor while the value is #define'd in . Signed-off-by: Sergei Shtylyov Signed-off-by: Greg Kroah-Hartman

Merge tag 'usb-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2015-02-15T18:24:55+00:00

Pull USB patches from Greg KH: "Here's the big pull request for the USB driver tree for 3.20-rc1. Nothing major happening here, just lots of gadget driver updates, new device ids, and a bunch of cleanups. All of these have been in linux-next for a while with no reported issues" * tag 'usb-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (299 commits) usb: musb: fix device hotplug behind hub usb: dwc2: Fix a bug in reading the endpoint directions from reg. staging: emxx_udc: fix the build error usb: Retry port status check on resume to work around RH bugs Revert "usb: Reset USB-3 devices on USB-3 link bounce" uhci-hub: use HUB_CHAR_* usb: kconfig: replace PPC_OF with PPC ehci-pci: disable for Intel MID platforms (update) usb: gadget: Kconfig: use bool instead of boolean usb: musb: blackfin: remove incorrect __exit_p() USB: fix use-after-free bug in usb_hcd_unlink_urb() ehci-pci: disable for Intel MID platforms usb: host: pci_quirks: joing string literals USB: add flag for HCDs that can't receive wakeup requests (isp1760-hcd) USB: usbfs: allow URBs to be reaped after disconnection cdc-acm: kill unnecessary messages cdc-acm: add sanity checks usb: phy: phy-generic: Fix USB PHY gpio reset usb: dwc2: fix USB core dependencies usb: renesas_usbhs: fix NULL pointer dereference in dma_release_channel() ...

usb: use %*pb[l] to print bitmaps including cpumasks and nodemasks

2015-02-14T05:21:38+00:00

printk and friends can now format bitmaps using '%*pb[l]'. cpumask and nodemask also provide cpumask_pr_args() and nodemask_pr_args() respectively which can be used to generate the two printf arguments necessary to format the specified cpu/nodemask. * drivers/uwb/drp.c::uwb_drp_handle_alien_drp() was formatting mas.bm into a buffer but never used it. Removed. Signed-off-by: Tejun Heo Acked-by: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

wusbcore: rh: use HUB_CHAR_*

2015-01-25T13:02:33+00:00

Fix using the bare numbers to set the 'wHubCharacteristics' field of the Hub Descriptor while the values are #define'd in . Signed-off-by: Sergei Shtylyov Signed-off-by: Greg Kroah-Hartman

wusb: replace memset by memzero_explicit

2014-12-03T00:15:02+00:00

Memset on a local variable may be removed when it is called just before the variable goes out of scope. Using memzero_explicit defeats this optimization. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ identifier x; type T; @@ { ... when any T x[...]; ... when any when exists - memset + memzero_explicit (x, -0, ...) ... when != x when strict } // This change was suggested by Daniel Borkmann Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman

usb: hub: rename khubd to hub_wq in documentation and comments

2014-09-24T05:33:19+00:00

USB hub has started to use a workqueue instead of kthread. Let's update the documentation and comments here and there. This patch mostly just replaces "khubd" with "hub_wq". There are only few exceptions where the whole sentence was updated. These more complicated changes can be found in the following files: Documentation/usb/hotplug.txt drivers/net/usb/usbnet.c drivers/usb/core/hcd.c drivers/usb/host/ohci-hcd.c drivers/usb/host/xhci.c Signed-off-by: Petr Mladek Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman

usb: wusbcore: fix device disconnect on rekey timeout

2014-09-24T05:06:59+00:00

If three or more wireless devices are connected and two of them disconnect between 1-3 seconds apart, it can cause the HWA to disconnect the remaining devices due to failing to see a DN_Alive message from them. This happens because when the HWA detects that the first device is gone, it will attempt to rekey the remaining devices. If one of the devices is not responding because it has also been disconnected but not yet timed out, the synchronous rekey operation running on the wusbd workqueue can block for up to 5 seconds. This will prevent the KEEPALIVE timer from running and DN_Alive messages from being processed because they are processed by the same workqueue. This patch moves the rekey operation to a separate workqueue since it is the only wusb work item that needs to communicate directly with wireless devices. The rest of the WUSB work items either perform no device IO or communicate directly with the host controller and should not be blocked out by a non-responding wireless device. Signed-off-by: Thomas Pugliese Signed-off-by: Greg Kroah-Hartman

usb: wusbcore: skip done segs before completing aborted transfer

2014-09-24T05:06:59+00:00

When completing an aborted transfer, skip done segs before calling wa_complete_remaining_xfer_segs to avoid a runtime warning. The warning is harmless in this case but avoiding it prevents false error reports. Signed-off-by: Thomas Pugliese Signed-off-by: Greg Kroah-Hartman