linux-stable.git/drivers/usb/core/devio.c, branch v4.4.76

USB: core: replace %p with %pK

2017-05-25T12:30:07+00:00

commit 2f964780c03b73de269b08d12aff96a9618d13f3 upstream.

Format specifier %p can leak kernel addresses while not valuing the
kptr_restrict system settings. When kptr_restrict is set to (1), kernel
pointers printed using the %pK format specifier will be replaced with
Zeros. Debugging Note : &pK prints only Zeros as address. If you need
actual address information, write 0 to kptr_restrict.

echo 0 > /proc/sys/kernel/kptr_restrict

[Found by poking around in a random vendor kernel tree, it would be nice
if someone would actually send these types of patches upstream - gkh]

Signed-off-by: Vamsi Krishna Samavedam 
Signed-off-by: Greg Kroah-Hartman

USB: avoid left shift by -1

2016-09-07T06:32:44+00:00

commit 53e5f36fbd2453ad69a3369a1db62dc06c30a4aa upstream.

UBSAN complains about a left shift by -1 in proc_do_submiturb().  This
can occur when an URB is submitted for a bulk or control endpoint on
a high-speed device, since the code doesn't bother to check the
endpoint type; normally only interrupt or isochronous endpoints have
a nonzero bInterval value.

Aside from the fact that the operation is illegal, it shouldn't matter
because the result isn't used.  Still, in theory it could cause a
hardware exception or other problem, so we should work around it.
This patch avoids doing the left shift unless the shift amount is >= 0.

The same piece of code has another problem.  When checking the device
speed (the exponential encoding for interrupt endpoints is used only
by high-speed or faster devices), we need to look for speed >=
USB_SPEED_SUPER as well as speed == USB_SPEED HIGH.  The patch adds
this check.

Signed-off-by: Alan Stern 
Reported-by: Vittorio Zecca 
Tested-by: Vittorio Zecca 
Suggested-by: Bjørn Mork 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: fix potential infoleak in devio

2016-08-20T16:09:16+00:00

commit 681fef8380eb818c0b845fca5d2ab1dcbab114ee upstream.

The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via “copy_to_user”.

Signed-off-by: Kangjie Lu 
Signed-off-by: Chas Williams 
Signed-off-by: Greg Kroah-Hartman

usb: devio: fix spacing

2015-08-08T22:17:17+00:00

Fix two occurrences of the checkpatch.pl error:

ERROR: space prohibited before that ',' (ctx:WxW)

Fix one occurrence of the checkpatch error:

ERROR: space required before the open parenthesis '('

Signed-off-by: Kris Borer 
Signed-off-by: Greg Kroah-Hartman

usb: devio: remove assignment from if condition

2015-08-05T19:29:19+00:00

Fix five occurrences of the checkpatch.pl error:

ERROR: do not use assignment in if condition

The semantic patch that makes this change is:

// 
@@
identifier i;
expression E;
statement S1, S2;
@@

+ i = E;
  if (
- (i = E)
+ i
  ) S1 else S2

@@
identifier i;
expression E;
statement S;
constant c;
binary operator b;
@@

+ i = E;
  if (
- (i = E)
+ i
  b
  c ) S
// 

Signed-off-by: Kris Borer 
Signed-off-by: Greg Kroah-Hartman

USB: devio: fix a condition in async_completed()

2015-05-24T16:29:36+00:00

Static checkers complain that the current condition is never true.  It
seems pretty likely that it's a typo and "URB" was intended instead of
"USB".

Fixes: 3d97ff63f899 ('usbdevfs: Use scatter-gather lists for large bulk transfers')
Signed-off-by: Dan Carpenter 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

drivers/usb/core: devio.c: Removed an uneeded space before tab

2015-04-10T12:00:22+00:00

Ran checkpatch.pl on file and removed a warning about an unwanted space before
a tab.

Signed-off-by: Chase Metzger 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: don't leak kernel data in siginfo

2015-02-24T16:38:46+00:00

When a signal is delivered, the information in the siginfo structure
is copied to userspace.  Good security practice dicatates that the
unused fields in this structure should be initialized to 0 so that
random kernel stack data isn't exposed to the user.  This patch adds
such an initialization to the two places where usbfs raises signals.

Signed-off-by: Alan Stern 
Reported-by: Dave Mielke 
CC: 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: allow URBs to be reaped after disconnection

2015-01-31T17:05:06+00:00

The usbfs API has a peculiar hole: Users are not allowed to reap their
URBs after the device has been disconnected.  There doesn't seem to be
any good reason for this; it is an ad-hoc inconsistency.

The patch allows users to issue the USBDEVFS_REAPURB and
USBDEVFS_REAPURBNDELAY ioctls (together with their 32-bit counterparts
on 64-bit systems) even after the device is gone.  If no URBs are
pending for a disconnected device then the ioctls will return -ENODEV
rather than -EAGAIN, because obviously no new URBs will ever be able
to complete.

The patch also adds a new capability flag for
USBDEVFS_GET_CAPABILITIES to indicate that the reap-after-disconnect
feature is supported.

Signed-off-by: Alan Stern 
Tested-by: Chris Dickens 
Acked-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

USB: devio: fix issue with log flooding

2014-08-01T23:01:46+00:00

usbfs allows user space to pass down an URB which sets URB_SHORT_NOT_OK
for output URBs. That causes usbcore to log messages without limit
for a nonsensical disallowed combination. The fix is to silently drop
the attribute in usbfs.
The problem is reported to exist since 3.14
https://www.virtualbox.org/ticket/13085

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman