linux-stable.git/drivers/usb/core/devio.c, branch linux-2.6.27.y

usb: core: fix information leak to userland

2010-12-09T21:24:18+00:00

commit 886ccd4520064408ce5876cfe00554ce52ecf4a7 upstream.

Structure usbdevfs_connectinfo is copied to userland with padding byted
after "slow" field uninitialized.  It leads to leaking of contents of
kernel stack memory.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Greg Kroah-Hartman

USB: fix usbfs regression

2010-04-01T22:52:29+00:00

commit 7152b592593b9d48b33f8997b1dfd6df9143f7ec upstream.

This patch (as1352) fixes a bug in the way isochronous input data is
returned to userspace for usbfs transfers.  The entire buffer must be
copied, not just the first actual_length bytes, because the individual
packets will be discontiguous if any of them are short.

Reported-by: Markus Rechberger 
Signed-off-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: properly clean up the as structure on error paths

2010-04-01T22:52:22+00:00

commit ddeee0b2eec2a51b0712b04de4b39e7bec892a53 upstream.

I notice that the processcompl_compat() function seems to be leaking the
'struct async *as' in the error paths.

I think that the calling convention is fundamentally buggered. The
caller is the one that did the "reap_as()" to get the as thing, the
caller should be the one to free it too.

Freeing it in the caller also means that it very clearly always gets
freed, and avoids the need for any "free in the error case too".

From: Linus Torvalds 
Cc: Alan Stern 
Cc: Marcus Meissner 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: only copy the actual data received

2010-04-01T22:52:22+00:00

commit d4a4683ca054ed9917dfc9e3ff0f7ecf74ad90d6 upstream.

We need to only copy the data received by the device to userspace, not
the whole kernel buffer, which can contain "stale" data.

Thanks to Marcus Meissner for pointing this out and testing the fix.

Reported-by: Marcus Meissner 
Tested-by: Marcus Meissner 
Cc: Alan Stern 
Cc: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: fix -ENOENT error code to be -ENODEV

2009-08-16T21:27:30+00:00

commit 01105a246345f011fde64d24a601090b646e9e4c upstream.

This patch (as1272) changes the error code returned when an open call
for a USB device node fails to locate the corresponding device.  The
appropriate error code is -ENODEV, not -ENOENT.

Signed-off-by: Alan Stern 
CC: Kay Sievers 
Signed-off-by: Greg Kroah-Hartman

USB: devio: Properly do access_ok() checks

2009-08-16T21:27:21+00:00

commit 18753ebc8a98efe0e8ff6167afb31cef220c8e50 upstream.

access_ok() checks must be done on every part of the userspace structure
that is accessed. If access_ok() on one part of the struct succeeded, it
does not imply it will succeed on other parts of the struct. (Does
depend on the architecture implementation of access_ok()).

This changes the __get_user() users to first check access_ok() on the
data structure.

Signed-off-by: Michael Buesch 
Cc: Pete Zaitcev 
Signed-off-by: Greg Kroah-Hartman

USB: handle zero-length usbfs submissions correctly

2009-07-30T23:06:03+00:00

commit 9180135bc80ab11199d482b6111e23f74d65af4a upstream.

This patch (as1262) fixes a bug in usbfs: It refuses to accept
zero-length transfers, and it insists that the buffer pointer be valid
even if there is no data being transferred.

The patch also consolidates a bunch of repetitive access_ok() checks
into a single check, which incidentally fixes the lack of such a check
for Isochronous URBs.

Signed-off-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: fix memleak in usbfs

2009-07-30T23:06:02+00:00

commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream.

This patch fixes a memory leak in devio.c::processcompl

If writing to user space fails the packet must be discarded, as it
already has been removed from the queue of completed packets.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: keep async URBs until the device file is closed

2009-03-23T22:00:12+00:00

commit 6ff10464096540e14d7575a72c50d0316d003714 upstream.

The usbfs driver manages a list of completed asynchronous URBs.  But
it is too eager to free the entries on this list: destroy_async() gets
called whenever an interface is unbound or a device is removed, and it
deallocates the outstanding struct async entries for all URBs on that
interface or device.  This is wrong; the user program should be able
to reap an URB any time after it has completed, regardless of whether
or not the interface is still bound or the device is still present.

This patch (as1222) moves the code for deallocating the completed list
entries from destroy_async() to usbdev_release().  The outstanding
entries won't be freed until the user program has closed the device
file, thereby eliminating any possibility that the remaining URBs
might still be reaped.

This fixes a bug in which a program can hang in the USBDEVFS_REAPURB
ioctl when the device is unplugged.

Reported-and-tested-by: Martin Poupe 
Signed-off-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: fix char-device disconnect handling

2009-02-02T16:28:11+00:00

commit 501950d846218ed80a776d2aae5aed9c8b92e778 upstream.

This patch (as1198) fixes a conceptual bug: Somewhere along the line
we managed to confuse USB class devices with USB char devices.  As a
result, the code to send a disconnect signal to userspace would not be
built if both CONFIG_USB_DEVICE_CLASS and CONFIG_USB_DEVICEFS were
disabled.

The usb_fs_classdev_common_remove() routine has been renamed to
usbdev_remove() and it is now called whenever any USB device is
removed, not just when a class device is unregistered.  The notifier
registration and unregistration calls are no longer conditionally
compiled.  And since the common removal code will always be called as
part of the char device interface, there's no need to call it again as
part of the usbfs interface; thus the invocation of
usb_fs_classdev_common_remove() has been taken out of
usbfs_remove_device().

Signed-off-by: Alan Stern 
Reported-by: Alon Bar-Lev 
Tested-by: Alon Bar-Lev 
Signed-off-by: Greg Kroah-Hartman