summaryrefslogtreecommitdiff
path: root/drivers/usb/misc
AgeCommit message (Collapse)AuthorFilesLines
2020-09-03USB: yurex: Fix bad gfp argumentAlan Stern1-1/+1
commit f176ede3a3bde5b398a6777a7f9ff091baa2d3ff upstream. The syzbot fuzzer identified a bug in the yurex driver: It passes GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING: do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247 WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190 kernel/sched/core.c:7253 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xf6/0x16e lib/dump_stack.c:118 panic+0x2aa/0x6e1 kernel/panic.c:231 __warn.cold+0x20/0x50 kernel/panic.c:600 report_bug+0x1bd/0x210 lib/bug.c:198 handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536 RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253 Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75 2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00 RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000 RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37 RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2 R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498 slab_alloc_node mm/slub.c:2816 [inline] slab_alloc mm/slub.c:2900 [inline] kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917 kmalloc include/linux/slab.h:554 [inline] dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251 usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547 usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570 yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495 This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL. Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-03USB: lvtest: return proper error code in probeEvgeny Novikov1-1/+1
commit 531412492ce93ea29b9ca3b4eb5e3ed771f851dd upstream. lvs_rh_probe() can return some nonnegative value from usb_control_msg() when it is less than "USB_DT_HUB_NONVAR_SIZE + 2" that is considered as a failure. Make lvs_rh_probe() return -EINVAL in this case. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200805090643.3432-1-novikov@ispras.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-03USB: sisusbvga: Fix a potential UB casued by left shifting a negative valueChangming Liu1-1/+1
[ Upstream commit 2b53a19284f537168fb506f2f40d7fda40a01162 ] The char buffer buf, receives data directly from user space, so its content might be negative and its elements are left shifted to form an unsigned integer. Since left shifting a negative value is undefined behavior, thus change the char to u8 to elimintate this UB. Signed-off-by: Changming Liu <charley.ashbringer@gmail.com> Link: https://lore.kernel.org/r/20200711043018.928-1-charley.ashbringer@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-11USB: iowarrior: fix up report size handling for some devicesGreg Kroah-Hartman1-10/+25
commit 17a82716587e9d7c3b246a789add490b2b5dcab6 upstream. In previous patches that added support for new iowarrior devices, the handling of the report size was not done correct. Fix that up and update the copyright date for the driver Reworked from an original patch written by Christoph Jung. Fixes: bab5417f5f01 ("USB: misc: iowarrior: add support for the 100 device") Fixes: 5f6f8da2d7b5 ("USB: misc: iowarrior: add support for the 28 and 28L devices") Fixes: 461d8deb26a7 ("USB: misc: iowarrior: add support for 2 OEMed devices") Cc: stable <stable@kernel.org> Reported-by: Christoph Jung <jung@codemercs.com> Link: https://lore.kernel.org/r/20200726094939.1268978-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-18usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnectZqiang1-0/+1
BUG: memory leak unreferenced object 0xffff888055046e00 (size 256): comm "kworker/2:9", pid 2570, jiffies 4294942129 (age 1095.500s) hex dump (first 32 bytes): 00 70 04 55 80 88 ff ff 18 bb 5a 81 ff ff ff ff .p.U......Z..... f5 96 78 81 ff ff ff ff 37 de 8e 81 ff ff ff ff ..x.....7....... backtrace: [<00000000d121dccf>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<00000000d121dccf>] slab_post_alloc_hook mm/slab.h:586 [inline] [<00000000d121dccf>] slab_alloc_node mm/slub.c:2786 [inline] [<00000000d121dccf>] slab_alloc mm/slub.c:2794 [inline] [<00000000d121dccf>] kmem_cache_alloc_trace+0x15e/0x2d0 mm/slub.c:2811 [<000000005c3c3381>] kmalloc include/linux/slab.h:555 [inline] [<000000005c3c3381>] usbtest_probe+0x286/0x19d0 drivers/usb/misc/usbtest.c:2790 [<000000001cec6910>] usb_probe_interface+0x2bd/0x870 drivers/usb/core/driver.c:361 [<000000007806c118>] really_probe+0x48d/0x8f0 drivers/base/dd.c:551 [<00000000a3308c3e>] driver_probe_device+0xfc/0x2a0 drivers/base/dd.c:724 [<000000003ef66004>] __device_attach_driver+0x1b6/0x240 drivers/base/dd.c:831 [<00000000eee53e97>] bus_for_each_drv+0x14e/0x1e0 drivers/base/bus.c:431 [<00000000bb0648d0>] __device_attach+0x1f9/0x350 drivers/base/dd.c:897 [<00000000838b324a>] device_initial_probe+0x1a/0x20 drivers/base/dd.c:944 [<0000000030d501c1>] bus_probe_device+0x1e1/0x280 drivers/base/bus.c:491 [<000000005bd7adef>] device_add+0x131d/0x1c40 drivers/base/core.c:2504 [<00000000a0937814>] usb_set_configuration+0xe84/0x1ab0 drivers/usb/core/message.c:2030 [<00000000e3934741>] generic_probe+0x6a/0xe0 drivers/usb/core/generic.c:210 [<0000000098ade0f1>] usb_probe_device+0x90/0xd0 drivers/usb/core/driver.c:266 [<000000007806c118>] really_probe+0x48d/0x8f0 drivers/base/dd.c:551 [<00000000a3308c3e>] driver_probe_device+0xfc/0x2a0 drivers/base/dd.c:724 Acked-by: Alan Stern <stern@rowland.harvard.edu> Reported-by: Kyungtae Kim <kt0755@gmail.com> Signed-off-by: Zqiang <qiang.zhang@windriver.com> Link: https://lore.kernel.org/r/20200612035210.20494-1-qiang.zhang@windriver.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-13treewide: replace '---help---' in Kconfig files with 'help'Masahiro Yamada2-4/+4
Since commit 84af7a6194e4 ("checkpatch: kconfig: prefer 'help' over '---help---'"), the number of '---help---' has been gradually decreasing, but there are still more than 2400 instances. This commit finishes the conversion. While I touched the lines, I also fixed the indentation. There are a variety of indentation styles found. a) 4 spaces + '---help---' b) 7 spaces + '---help---' c) 8 spaces + '---help---' d) 1 space + 1 tab + '---help---' e) 1 tab + '---help---' (correct indentation) f) 1 tab + 1 space + '---help---' g) 1 tab + 2 spaces + '---help---' In order to convert all of them to 1 tab + 'help', I ran the following commend: $ find . -name 'Kconfig*' | xargs sed -i 's/^[[:space:]]*---help---/\thelp/' Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
2020-04-27Merge 5.7-rc3 into usb-nextGreg Kroah-Hartman2-17/+17
We need the USB fixes in here too. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-23USB: sisusbvga: Change port variable from signed to unsignedChangming Liu2-17/+17
Change a bunch of arguments of wrapper functions which pass signed integer to an unsigned integer which might cause undefined behaviors when sign integer overflow. Signed-off-by: Changming Liu <liu.changm@northeastern.edu> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/BL0PR06MB45482D71EA822D75A0E60A2EE5D50@BL0PR06MB4548.namprd06.prod.outlook.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-16USB: misc: Use the correct style for SPDX License IdentifierNishad Kamdar4-4/+4
This patch corrects the SPDX License Identifier style in header files related to USB Miscellaneous drivers. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used). Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Nishad Kamdar <nishadkamdar@gmail.com> Link: https://lore.kernel.org/r/20200404094638.GA5319@nishad Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-10Merge 5.6-rc5 into usb-nextGreg Kroah-Hartman1-4/+16
We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-04usb: usb251xb: fix regulator probe and error handlingMarco Felsch1-4/+16
Commit 4d7201cda226 ("usb: usb251xb: add vdd supply support") didn't covered the non-DT use-case and so the regualtor_enable() call during probe will fail on those platforms. Also the commit didn't handled the error case correctly. Move devm_regulator_get() out of usb251xb_get_ofdata() to address the 1st issue. This can be done without worries because devm_regulator_get() handles the non-DT use-case too. Add devm_add_action_or_reset() to address the 2nd bug. Fixes: 4d7201cda226 ("usb: usb251xb: add vdd supply support") Signed-off-by: Marco Felsch <m.felsch@pengutronix.de> Cc: stable <stable@vger.kernel.org> Acked-by: Richard Leitner <richard.leitner@skidata.com> Link: https://lore.kernel.org/r/20200226072644.18490-1-m.felsch@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-24Merge 5.6-rc3 into usb-nextGreg Kroah-Hartman1-2/+29
We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-17USB: misc: iowarrior: add support for the 100 deviceGreg Kroah-Hartman1-2/+7
Add a new device id for the 100 devie. It has 4 interfaces like the 28 and 28L devices but a larger endpoint so more I/O pins. Cc: Christoph Jung <jung@codemercs.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20200214161148.GA3963518@kroah.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-13USB: apple-mfi-fastcharge: fix endianess issue in probeOliver Neukum1-3/+3
The product ID is little endian and needs to be converted. Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Oliver Neukum <oneukum@suse.com> Reviewed-by: Bastien Nocera <hadess@hadess.net> Link: https://lore.kernel.org/r/20200213111336.32392-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-12USB: Add driver to control USB fast charge for iOS devicesBastien Nocera3-0/+248
iOS devices will not draw more than 500mA unless instructed to do so. Setting the charge type power supply property to "fast" tells the device to start drawing more power, using the same procedure that official "MFi" chargers would. Signed-off-by: Bastien Nocera <hadess@hadess.net> Acked-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/20191016093933.693-7-hadess@hadess.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-12USB: misc: iowarrior: add support for the 28 and 28L devicesGreg Kroah-Hartman1-2/+13
Add new device ids for the 28 and 28L devices. These have 4 interfaces instead of 2, but the driver binds the same, so the driver changes are minimal. Cc: Christoph Jung <jung@codemercs.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200212040422.2991-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-12USB: misc: iowarrior: add support for 2 OEMed devicesGreg Kroah-Hartman1-2/+13
Add support for two OEM devices that are identical to existing IO-Warrior devices, except for the USB device id. Cc: Christoph Jung <jung@codemercs.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200212040422.2991-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-30usb: usb3503: Convert to use GPIO descriptorsLinus Walleij1-59/+35
This converts the USB3503 to pick GPIO descriptors from the device tree instead of iteratively picking out GPIO number references and then referencing these from the global GPIO numberspace. The USB3503 is only used from device tree among the in-tree platforms. If board files would still desire to use it they can provide machine descriptor tables. Make sure to preserve semantics such as the reset delay introduced by Stefan. Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Stefan Agner <stefan@agner.ch> Cc: Krzysztof Kozlowski <krzk@kernel.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> [mszyprow: invert the logic behind reset GPIO line] Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Link: https://lore.kernel.org/r/20191211145226.25074-1-m.szyprowski@samsung.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-10USB: adutux: fix interface sanity checkJohan Hovold1-1/+1
Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 03270634e242 ("USB: Add ADU support for Ontrak ADU devices") Cc: stable <stable@vger.kernel.org> # 2.6.19 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191210112601.3561-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-10USB: idmouse: fix interface sanity checksJohan Hovold1-1/+1
Make sure to use the current alternate setting when verifying the interface descriptors to avoid binding to an invalid interface. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191210112601.3561-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-21usb: misc: Fix Kconfig indentationKrzysztof Kozlowski1-9/+9
Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Link: https://lore.kernel.org/r/20191121132901.29186-1-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-11USB: chaoskey: fix error case of a timeoutOliver Neukum1-3/+21
In case of a timeout or if a signal aborts a read communication with the device needs to be ended lest we overwrite an active URB the next time we do IO to the device, as the URB may still be active. Signed-off-by: Oliver Neukum <oneukum@suse.de> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191107142856.16774-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07appledisplay: fix error handling in the scheduled workOliver Neukum1-1/+7
The work item can operate on 1. stale memory left over from the last transfer the actual length of the data transfered needs to be checked 2. memory already freed the error handling in appledisplay_probe() needs to cancel the work in that case Reported-and-tested-by: syzbot+495dab1f175edc9c2f13@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneukum@suse.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191106124902.7765-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: drop superfluous newlinesJohan Hovold1-5/+0
Drop some superfluous newlines before conditionals which made the code harder to read. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-15-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: drop superfluous bracketsJohan Hovold1-12/+6
Drop superfluous brackets around single-line blocks. Also add missing white space around operators in a for-expression being modified. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-14-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: clean up runaway white spaceJohan Hovold1-85/+87
Drop space between function identifiers and opening parenthesis, which was no longer even used consistently within the driver. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-13-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: drop redundant endianness commentsJohan Hovold1-3/+3
The endianness is already encoded in the type specifier so drop the redundant little-endian comments from the message structs. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-12-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: drop unnecessary packed attributesJohan Hovold1-2/+2
Drop the packed attributes from the two message structs whose fields are naturally aligned and do not have any padding. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-11-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: clean up pointer declarations in driver dataJohan Hovold1-8/+8
Clean up the pointer declarations in the driver data, whose style wasn't even consistent with the rest of the driver. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-10-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: remove tower_abort_transfers()Johan Hovold1-15/+5
Drop the tower_abort_transfers() function which is now only called from release and instead explicitly kill the two URBs. This incidentally also fixes the outdated comment about freeing memory. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-9-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: stop interrupt-out URB unconditionallyJohan Hovold1-2/+1
Stop also the interrupt-out URB unconditionally in tower_abort_transfers() which is called from release() (for connected devices). Calling usb_kill_urb() for an idle URB is perfectly fine. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-8-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: drop redundant interrupt-in running flagJohan Hovold1-16/+5
Drop the redundant interrupt-in-running flag, which tried to keep track of when the interrupt-in URB was in flight. This isn't needed since we can stop the URB unconditionally in tower_abort_transfers() and the URB can not be submitted while usb_kill_urb() is running anyway. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-7-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: drop noisy disconnect messagesJohan Hovold1-2/+0
User space already sees -ENODEV in case it tries to do I/O post disconnect, no need to spam the logs with printk messages that don't even include any device-id information. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: drop redundant open_count checkJohan Hovold1-8/+0
Drop redundant open_count check in release; the open count is used as a flag and is only set to 0 or 1. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: zero driver data at allocationJohan Hovold1-23/+2
Zero the driver data at allocation rather than depend on explicit zeroing, which easy to miss. Also drop an unnecessary driver-data pointer initialisation. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: drop redundant NULL checkJohan Hovold1-3/+0
Drop redundant NULL check from tower_abort_transfers(), which is never called with a NULL argument. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: legousbtower: drop redundant MODULE_LICENSE ifdefJohan Hovold1-2/+0
The MODULE_LICENSE macro is unconditionally defined in module.h, no need to ifdef its use. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105084152.16322-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: idmouse: clean up runaway white spaceJohan Hovold1-5/+5
Drop space between function identifiers and opening parenthesis, which was no longer even used consistently within the driver. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105103638.4929-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: idmouse: drop redundant open-count check from releaseJohan Hovold1-6/+0
The open count will always be exactly one when release is called, so drop the redundant sanity check. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105103638.4929-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-07USB: idmouse: simplify disconnect handlingJohan Hovold1-18/+2
Since commit d4ead16f50f9 ("USB: prevent char device open/deregister race") core prevents further calls to open() after usb_deregister_dev() returns so there's no need to use the interface data for synchronisation. This effectively reverts commit 54d2bc068fd2 ("USB: fix locking in idmouse") with respect to the open-disconnect race. Note that the driver already uses a present flag to suppress I/O post disconnect (even if all USB I/O take place at open). Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191105103638.4929-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-04usb: usb251xb: Add support for USB2422Uwe Kleine-König1-0/+12
The USB2422 uses a different package that the USB251x and only comes in a variant with 2 downstream ports. Other than that it is software compatible. Tested-by: Carsten Stelling <carsten.stelling@goerlitz.com> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20191023105250.16537-3-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-04usb: usb251xb: Drop some unused definesUwe Kleine-König1-5/+0
The five removed symbols are unused since they were introduced in commit 3ec72a2a1e5d ("usb: misc: add USB251xB/xBi Hi-Speed Hub Controller Driver") back in 2017. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20191023105250.16537-1-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-04Merge 5.4-rc6 into usb-nextGreg Kroah-Hartman1-6/+7
We need the USB fixes in here to build on top of. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-28USB: ldusb: fix control-message timeoutJohan Hovold1-1/+1
USB control-message timeouts are specified in milliseconds, not jiffies. Waiting 83 minutes for a transfer to complete is a bit excessive. Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver") Cc: stable <stable@vger.kernel.org> # 2.6.13 Reported-by: syzbot+a4fbb3bb76cda0ea4e58@syzkaller.appspotmail.com Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191022153127.22295-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-28USB: ldusb: use unsigned size format specifiersJohan Hovold1-3/+4
A recent info-leak bug manifested itself along with warning about a negative buffer overflow: ldusb 1-1:0.28: Read buffer overflow, -131383859965943 bytes dropped when it was really a rather large positive one. A sanity check that prevents this has now been put in place, but let's fix up the size format specifiers, which should all be unsigned. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191022143203.5260-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-28USB: ldusb: fix ring-buffer lockingJohan Hovold1-2/+2
The custom ring-buffer implementation was merged without any locking or explicit memory barriers, but a spinlock was later added by commit 9d33efd9a791 ("USB: ldusb bugfix"). The lock did not cover the update of the tail index once the entry had been processed, something which could lead to memory corruption on weakly ordered architectures or due to compiler optimisations. Specifically, a completion handler running on another CPU might observe the incremented tail index and update the entry before ld_usb_read() is done with it. Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver") Fixes: 9d33efd9a791 ("USB: ldusb bugfix") Cc: stable <stable@vger.kernel.org> # 2.6.13 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191022143203.5260-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-27Merge 5.4-rc5 into usb-nextGreg Kroah-Hartman2-16/+14
We want the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-18USB: ldusb: fix read info leaksJohan Hovold1-7/+11
Fix broken read implementation, which could be used to trigger slab info leaks. The driver failed to check if the custom ring buffer was still empty when waking up after having waited for more data. This would happen on every interrupt-in completion, even if no data had been added to the ring buffer (e.g. on disconnect events). Due to missing sanity checks and uninitialised (kmalloced) ring-buffer entries, this meant that huge slab info leaks could easily be triggered. Note that the empty-buffer check after wakeup is enough to fix the info leak on disconnect, but let's clear the buffer on allocation and add a sanity check to read() to prevent further leaks. Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver") Cc: stable <stable@vger.kernel.org> # 2.6.13 Reported-by: syzbot+6fe95b826644f7f12b0b@syzkaller.appspotmail.com Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191018151955.25135-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-15USB: legousbtower: fix a signedness bug in tower_probe()Dan Carpenter1-1/+1
The problem is that sizeof() is unsigned long so negative error codes are type promoted to high positive values and the condition becomes false. Fixes: 1d427be4a39d ("USB: legousbtower: fix slab info leak at probe") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191011141115.GA4521@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-15USB: legousbtower: fix memleak on disconnectJohan Hovold1-4/+1
If disconnect() races with release() after a process has been interrupted, release() could end up returning early and the driver would fail to free its driver data. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191010125835.27031-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.39.0) at 2026-01-22 17:46:29 +0300