linux-stable.git/drivers/usb/core/driver.c, branch linux-3.14.y

USB: usb_driver_claim_interface: add sanity checking

2016-04-12T16:12:40+00:00

commit 0b818e3956fc1ad976bee791eadcbb3b5fec5bfd upstream.

Attacks that trick drivers into passing a NULL pointer
to usb_driver_claim_interface() using forged descriptors are
known. This thwarts them by sanity checking.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume

2014-06-11T18:54:13+00:00

commit 8ef42ddd9a53b73e6fc3934278710c27f80f324f upstream.

Not all host controller drivers have bus-suspend and bus-resume
methods.  When one doesn't, it will cause problems if runtime PM is
enabled in the kernel.  The PM core will attempt to suspend the
controller's root hub, the suspend will fail because there is no
bus-suspend routine, and a -EBUSY error code will be returned to the
PM core.  This will cause the suspend attempt to be repeated shortly
thereafter, in a never-ending loop.

Part of the problem is that the original error code -ENOENT gets
changed to -EBUSY in usb_runtime_suspend(), on the grounds that the PM
core will interpret -ENOENT as meaning that the root hub has gotten
into a runtime-PM error state.  While this change is appropriate for
real USB devices, it's not such a good idea for a root hub.  In fact,
considering the root hub to be in a runtime-PM error state would not
be far from the truth.  Therefore this patch updates
usb_runtime_suspend() so that it adjusts error codes only for
non-root-hub devices.

Furthermore, the patch attempts to prevent the problem from occurring
in the first place by not enabling runtime PM by default for root hubs
whose host controller driver doesn't have bus_suspend and bus_resume
methods.

Signed-off-by: Alan Stern 
Reported-by: Will Deacon 
Tested-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman

USB: unbind all interfaces before rebinding any

2014-05-06T14:59:34+00:00

commit 6aec044cc2f5670cf3b143c151c8be846499bd15 upstream.

When a driver doesn't have pre_reset, post_reset, or reset_resume
methods, the USB core unbinds that driver when its device undergoes a
reset or a reset-resume, and then rebinds it afterward.

The existing straightforward implementation can lead to problems,
because each interface gets unbound and rebound before the next
interface is handled.  If a driver claims additional interfaces, the
claim may fail because the old binding instance may still own the
additional interface when the new instance tries to claim it.

This patch fixes the problem by first unbinding all the interfaces
that are marked (i.e., their needs_binding flag is set) and then
rebinding all of them.

The patch also makes the helper functions in driver.c a little more
uniform and adjusts some out-of-date comments.

Signed-off-by: Alan Stern 
Reported-and-tested-by: "Poulain, Loic" 
Signed-off-by: Greg Kroah-Hartman

usb: core: Fix potential memory leak adding dyn USBdevice IDs

2014-02-05T19:39:30+00:00

Fix a memory leak in the usb_store_new_id() error paths. When bailing out
due to sanity checks, the function left the already allocated usb_dynid
struct in place. This regression was introduced by the following commits:

c63fe8f6 (usb: core: add sanity checks when using bInterfaceClass with new_id)
1b9fb31f (usb: core: check for valid id_table when using the RefId feature)
52a6966c (usb: core: bail out if user gives an unknown RefId when using new_id)

Detected by Coverity: CID 1162604.

Signed-off-by: Christian Engelmayer 
Acked-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman

usb: core: check for valid id_table when using the RefId feature

2014-01-13T23:54:03+00:00

When implementing the RefId feature, it was missed that id_tables can be
NULL under special circumstances. Bail out in that case.

Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman

usb: core: bail out if user gives an unknown RefId when using new_id

2014-01-13T00:09:35+00:00

If users use the new RefId feature of new_id, give them an error message
if they provided an unknown reference. That helps detecting typos.

Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman

usb: core: allow a reference device for new_id

2014-01-11T00:54:35+00:00

Often, usb drivers need some driver_info to get a device to work. To
have access to driver_info when using new_id, allow to pass a reference
vendor:product tuple from which new_id will inherit driver_info.

Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman

usb: core: add sanity checks when using bInterfaceClass with new_id

2014-01-11T00:54:35+00:00

Check if that field is actually used and if so, bail out if it exeeds a
u8. Make it also future-proof by not requiring "exactly three"
parameters in new_id, but simply "more than two".

Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman

usb: core: Remove superfluous name casts

2013-12-03T19:17:28+00:00

device_driver.name is "const char *"

Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Greg Kroah-Hartman

USB: change dev_warn about missing reset-resume to dev_dbg

2013-10-19T21:10:16+00:00

This patch changes a dev_warn() call in usbcore to dev_dbg().  It's
not necessary to warn about drivers missing a reset-resume callback,
since the reset-resume method is optional.

Signed-off-by: Alan Stern 
CC: Clemens Ladisch 
Signed-off-by: Greg Kroah-Hartman