linux-stable.git/drivers/net/usb, branch v3.16.78

USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data

2019-03-25T17:32:32+00:00

commit 5146f95df782b0ac61abde36567e718692725c89 upstream.

The function hso_probe reads if_num from the USB device (as an u8) and uses
it without a length check to index an array, resulting in an OOB memory read
in hso_probe or hso_get_config_data.

Add a length check for both locations and updated hso_probe to bail on
error.

This issue has been assigned CVE-2018-19985.

Reported-by: Hui Peng 
Reported-by: Mathias Payer 
Signed-off-by: Hui Peng 
Signed-off-by: Mathias Payer 
Reviewed-by: Sebastian Andrzej Siewior 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

smsc95xx: Check for Wake-on-LAN modes

2018-12-16T22:09:30+00:00

commit c530c471ba37bdd9fe1c7185b01455c00ae606fb upstream.

The driver does not check for Wake-on-LAN modes specified by an user,
but will conditionally set the device as wake-up enabled or not based on
that, which could be a very confusing user experience.

Fixes: e0e474a83c18 ("smsc95xx: add wol magic packet support")
Signed-off-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

smsc75xx: Check for Wake-on-LAN modes

2018-12-16T22:09:30+00:00

commit 9c734b2769a73eea2e9e9767c0e0bf839ff23679 upstream.

The driver does not check for Wake-on-LAN modes specified by an user,
but will conditionally set the device as wake-up enabled or not based on
that, which could be a very confusing user experience.

Fixes: 6c636503260d ("smsc75xx: add wol magic packet support")
Signed-off-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

r8152: Check for supported Wake-on-LAN Modes

2018-12-16T22:09:29+00:00

commit f2750df1548bd8a2b060eb609fc43ca82811af4c upstream.

The driver does not check for Wake-on-LAN modes specified by an user,
but will conditionally set the device as wake-up enabled or not based on
that, which could be a very confusing user experience.

Fixes: 21ff2e8976b1 ("r8152: support WOL")
Signed-off-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

sr9800: Check for supported Wake-on-LAN modes

2018-12-16T22:09:29+00:00

commit c5cb93e994ffb43b7b3b1ff10b9f928f54574a36 upstream.

The driver currently silently accepts unsupported Wake-on-LAN modes
(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
which is confusing.

Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support")
Signed-off-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

ax88179_178a: Check for supported Wake-on-LAN modes

2018-12-16T22:09:29+00:00

commit 5ba6b4aa9a410c5e2c6417df52b5e2118ea9b467 upstream.

The driver currently silently accepts unsupported Wake-on-LAN modes
(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
which is confusing.

Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
Signed-off-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

asix: Check for supported Wake-on-LAN modes

2018-12-16T22:09:28+00:00

commit c4ce446e33d7a0e978256ac6fea4c80e59d9de5f upstream.

The driver currently silently accepts unsupported Wake-on-LAN modes
(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
which is confusing.

Fixes: 2e55cc7210fe ("[PATCH] USB: usbnet (3/9) module for ASIX Ethernet adapters")
Signed-off-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

smsc75xx: Add workaround for gigabit link up hardware errata.

2018-11-20T18:05:35+00:00

commit d461e3da905332189aad546b2ad9adbe6071c7cc upstream.

In certain conditions, the device may not be able to link in gigabit mode. This software workaround ensures that the device will not enter the failure state.

Fixes: d0cad871703b898a442e4049c532ec39168e5b57 ("SMSC75XX USB 2.0 Gigabit Ethernet Devices")
Signed-off-by: Yuiko Oshino 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

qmi_wwan: do not steal interfaces from class drivers

2018-10-21T07:45:52+00:00

commit 5697db4a696c41601a1d15c1922150b4dbf5726c upstream.

The USB_DEVICE_INTERFACE_NUMBER matching macro assumes that
the { vendorid, productid, interfacenumber } set uniquely
identifies one specific function.  This has proven to fail
for some configurable devices. One example is the Quectel
EM06/EP06 where the same interface number can be either
QMI or MBIM, without the device ID changing either.

Fix by requiring the vendor-specific class for interface number
based matching.  Functions of other classes can and should use
class based matching instead.

Fixes: 03304bcb5ec4 ("net: qmi_wwan: use fixed interface number matching")
Signed-off-by: Bjørn Mork 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2

2018-10-21T07:45:48+00:00

commit 9306b38e42cb266f98bff6f6f4c1c652aa79ba45 upstream.

This patch adds support for PID 0x90b2 of ublox R410M.

qmicli -d /dev/cdc-wdm0 --dms-get-manufacturer
[/dev/cdc-wdm0] Device manufacturer retrieved:
        Manufacturer: 'u-blox'

qmicli -d /dev/cdc-wdm0 --dms-get-model
[/dev/cdc-wdm0] Device model retrieved:
        Model: 'SARA-R410M-02B'

Signed-off-by: SZ Lin (林上智) 
Acked-by: Bjørn Mork 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings