linux-stable.git/drivers/usb/core, branch linux-2.6.27.y

USB: prevent buggy hubs from crashing the USB stack

2011-04-30T14:52:56+00:00

commit d199c96d41d80a567493e12b8e96ea056a1350c1 upstream.

If anyone comes across a high-speed hub that (by mistake or by design)
claims to have no Transaction Translators, plugging a full- or
low-speed device into it will cause the USB stack to crash.  This
patch (as1446) prevents the problem by ignoring such devices, since
the kernel has no way to communicate with them.

Signed-off-by: Alan Stern 
Tested-by: Perry Neben 
Signed-off-by: Greg Kroah-Hartman

usb: core: fix information leak to userland

2010-12-09T21:24:18+00:00

commit 886ccd4520064408ce5876cfe00554ce52ecf4a7 upstream.

Structure usbdevfs_connectinfo is copied to userland with padding byted
after "slow" field uninitialized.  It leads to leaking of contents of
kernel stack memory.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Greg Kroah-Hartman

USB: fix testing the wrong variable in fs_create_by_name()

2010-05-26T21:27:07+00:00

commit fa7fe7af146a7b613e36a311eefbbfb5555325d1 upstream.

There is a typo here.  We should be testing "*dentry" which was just
assigned instead of "dentry".  This could result in dereferencing an
ERR_PTR inside either usbfs_mkdir() or usbfs_create().

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

USB: fix usbfs regression

2010-04-01T22:52:29+00:00

commit 7152b592593b9d48b33f8997b1dfd6df9143f7ec upstream.

This patch (as1352) fixes a bug in the way isochronous input data is
returned to userspace for usbfs transfers.  The entire buffer must be
copied, not just the first actual_length bytes, because the individual
packets will be discontiguous if any of them are short.

Reported-by: Markus Rechberger 
Signed-off-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: properly clean up the as structure on error paths

2010-04-01T22:52:22+00:00

commit ddeee0b2eec2a51b0712b04de4b39e7bec892a53 upstream.

I notice that the processcompl_compat() function seems to be leaking the
'struct async *as' in the error paths.

I think that the calling convention is fundamentally buggered. The
caller is the one that did the "reap_as()" to get the as thing, the
caller should be the one to free it too.

Freeing it in the caller also means that it very clearly always gets
freed, and avoids the need for any "free in the error case too".

From: Linus Torvalds 
Cc: Alan Stern 
Cc: Marcus Meissner 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: only copy the actual data received

2010-04-01T22:52:22+00:00

commit d4a4683ca054ed9917dfc9e3ff0f7ecf74ad90d6 upstream.

We need to only copy the data received by the device to userspace, not
the whole kernel buffer, which can contain "stale" data.

Thanks to Marcus Meissner for pointing this out and testing the fix.

Reported-by: Marcus Meissner 
Tested-by: Marcus Meissner 
Cc: Alan Stern 
Cc: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

USB: add missing delay during remote wakeup

2010-01-28T23:20:32+00:00

commit 49d0f078f494b9d81e820a13dd8093a9bfb0b6b1 upstream.

This patch (as1330) fixes a bug in khbud's handling of remote
wakeups.  When a device sends a remote-wakeup request, the parent hub
(or the host controller driver, for directly attached devices) begins
the resume sequence and notifies khubd when the sequence finishes.  At
this point the port's SUSPEND feature is automatically turned off.

However the device needs an additional 10-ms resume-recovery time
(TRSMRCY in the USB spec).  Khubd does not wait for this delay if the
SUSPEND feature is off, and as a result some devices fail to behave
properly following a remote wakeup.  This patch adds the missing
delay to the remote-wakeup path.

It also extends the resume-signalling delay used by ehci-hcd and
uhci-hcd from 20 ms (the value in the spec) to 25 ms (the value we use
for non-remote-wakeup resumes).  The extra time appears to help some
devices.

Signed-off-by: Alan Stern 
Cc: Rickard Bellini 
Signed-off-by: Greg Kroah-Hartman

USB: usbfs: fix -ENOENT error code to be -ENODEV

2009-08-16T21:27:30+00:00

commit 01105a246345f011fde64d24a601090b646e9e4c upstream.

This patch (as1272) changes the error code returned when an open call
for a USB device node fails to locate the corresponding device.  The
appropriate error code is -ENODEV, not -ENOENT.

Signed-off-by: Alan Stern 
CC: Kay Sievers 
Signed-off-by: Greg Kroah-Hartman

USB: devio: Properly do access_ok() checks

2009-08-16T21:27:21+00:00

commit 18753ebc8a98efe0e8ff6167afb31cef220c8e50 upstream.

access_ok() checks must be done on every part of the userspace structure
that is accessed. If access_ok() on one part of the struct succeeded, it
does not imply it will succeed on other parts of the struct. (Does
depend on the architecture implementation of access_ok()).

This changes the __get_user() users to first check access_ok() on the
data structure.

Signed-off-by: Michael Buesch 
Cc: Pete Zaitcev 
Signed-off-by: Greg Kroah-Hartman

USB: handle zero-length usbfs submissions correctly

2009-07-30T23:06:03+00:00

commit 9180135bc80ab11199d482b6111e23f74d65af4a upstream.

This patch (as1262) fixes a bug in usbfs: It refuses to accept
zero-length transfers, and it insists that the buffer pointer be valid
even if there is no data being transferred.

The patch also consolidates a bunch of repetitive access_ok() checks
into a single check, which incidentally fixes the lack of such a check
for Isochronous URBs.

Signed-off-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman