linux-stable.git/drivers/usb/core, branch v3.14.76

USB: fix up incorrect quirk

2016-08-16T07:29:02+00:00

Ben Hutchings reported that commit ddbe1fca0bcb ("USB: Add device quirk
for ASUS T100 Base Station keyboard") was incorrectly ported.

This patch fixes up the quirk by putting it in the correct table.

Reported-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

USB: fix invalid memory access in hub_activate()

2016-08-16T07:29:01+00:00

commit e50293ef9775c5f1cf3fcc093037dd6a8c5684ea upstream.

Commit 8520f38099cc ("USB: change hub initialization sleeps to
delayed_work") changed the hub_activate() routine to make part of it
run in a workqueue.  However, the commit failed to take a reference to
the usb_hub structure or to lock the hub interface while doing so.  As
a result, if a hub is plugged in and quickly unplugged before the work
routine can run, the routine will try to access memory that has been
deallocated.  Or, if the hub is unplugged while the routine is
running, the memory may be deallocated while it is in active use.

This patch fixes the problem by taking a reference to the usb_hub at
the start of hub_activate() and releasing it at the end (when the work
is finished), and by locking the hub interface while the work routine
is running.  It also adds a check at the start of the routine to see
if the hub has already been disconnected, in which nothing should be
done.

Signed-off-by: Alan Stern 
Reported-by: Alexandru Cornea 
Tested-by: Alexandru Cornea 
Fixes: 8520f38099cc ("USB: change hub initialization sleeps to delayed_work")
Signed-off-by: Greg Kroah-Hartman 
[ luis: backported to 3.16:
  - Added forward declaration of hub_release() which mainline had with commit
    32a6958998c5 ("usb: hub: convert khubd into workqueue") ]
Signed-off-by: Luis Henriques 
Signed-off-by: Charles (Chas) Williams 
Signed-off-by: Greg Kroah-Hartman

usb: quirks: Add no-lpm quirk for Acer C120 LED Projector

2016-07-27T16:55:48+00:00

commit 32cb0b37098f4beeff5ad9e325f11b42a6ede56c upstream.

The Acer C120 LED Projector is a USB-3 connected pico projector which
takes both its power and video data from USB-3.

In combination with some hubs this device does not play well with
lpm, so disable lpm for it.

Signed-off-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

usb: hcd: out of bounds access in for_each_companion

2016-05-04T21:51:23+00:00

commit e86103a75705c7c530768f4ffaba74cf382910f2 upstream.

On BXT platform Host Controller and Device Controller figure as
same PCI device but with different device function. HCD should
not pass data to Device Controller but only to Host Controllers.
Checking if companion device is Host Controller, otherwise skip.

Signed-off-by: Robert Dobrowolski 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

Revert "usb: hub: do not clear BOS field during reset device"

2016-04-20T06:40:46+00:00

commit e5bdfd50d6f76077bf8441d130c606229e100d40 upstream.

This reverts commit d8f00cd685f5c8e0def8593e520a7fef12c22407.

Tony writes:

This upstream commit is causing an oops:
d8f00cd685f5 ("usb: hub: do not clear BOS field during reset device")

This patch has already been included in several -stable kernels.  Here
are the affected kernels:
4.5.0-rc4 (current git)
4.4.2
4.3.6 (currently in review)
4.1.18
3.18.27
3.14.61

How to reproduce the problem:
Boot kernel with slub debugging enabled (otherwise memory corruption
will cause random oopses later instead of immediately)
Plug in USB 3.0 disk to xhci USB 3.0 port
dd if=/dev/sdc of=/dev/null bs=65536
(where /dev/sdc is the USB 3.0 disk)
Unplug USB cable while dd is still going
Oops is immediate:

Reported-by: Tony Battersby 
Cc: Du, Changbin 
Cc: Roger Quadros 
Signed-off-by: Greg Kroah-Hartman

USB: usb_driver_claim_interface: add sanity checking

2016-04-12T16:12:40+00:00

commit 0b818e3956fc1ad976bee791eadcbb3b5fec5bfd upstream.

Attacks that trick drivers into passing a NULL pointer
to usb_driver_claim_interface() using forged descriptors are
known. This thwarts them by sanity checking.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

usb: hub: fix a typo in hub_port_init() leading to wrong logic

2016-04-12T16:12:40+00:00

commit 0d5ce778c43bf888328231bcdce05d5c860655aa upstream.

A typo of j for i led to a logic bug. To rule out future
confusion, the variable names are made meaningful.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

usb: retry reset if a device times out

2016-04-12T16:12:40+00:00

commit 264904ccc33c604d4b3141bbd33808152dfac45b upstream.

Some devices I got show an inability to operate right after
power on if they are already connected. They are beyond recovery
if the descriptors are requested multiple times. So in case of
a timeout we rather bail early and reset again. But it must be
done only on the first loop lest we get into a reset/time out
spiral that can be overcome with a retry.

This patch is a rework of a patch that fell through the cracks.
http://www.spinics.net/lists/linux-usb/msg103263.html

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

usb: hub: do not clear BOS field during reset device

2016-02-17T20:34:38+00:00

commit d8f00cd685f5c8e0def8593e520a7fef12c22407 upstream.

In function usb_reset_and_verify_device, the old BOS descriptor may
still be used before allocating a new one. (usb_unlocked_disable_lpm
function uses it under the situation that it fails to disable lpm.)
So we cannot set the udev->bos to NULL before that, just keep what it
was. It will be overwrite when allocating a new one.

Crash log:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000010
IP: [] usb_enable_link_state+0x2d/0x2f0
Call Trace:
[] ? usb_set_lpm_timeout+0x12b/0x140
[] usb_enable_lpm+0x81/0xa0
[] usb_disable_lpm+0xa8/0xc0
[] usb_unlocked_disable_lpm+0x2c/0x50
[] usb_reset_and_verify_device+0xc3/0x710
[] ? usb_sg_wait+0x13d/0x190
[] usb_reset_device+0x133/0x280
[] usb_stor_port_reset+0x61/0x70
[] usb_stor_invoke_transport+0x88/0x520

Signed-off-by: Du, Changbin 
Signed-off-by: Greg Kroah-Hartman

usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message

2016-01-23T04:34:52+00:00

commit 5377adb092664d336ac212499961cac5e8728794 upstream.

usb_parse_ss_endpoint_companion() now decodes the burst multiplier
correctly in order to check that it's <= 3, but still uses the wrong
expression if warning that it's > 3.

Fixes: ff30cbc8da42 ("usb: Use the USB_SS_MULT() macro to get the ...")
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman