linux-stable.git/drivers/usb/misc, branch linux-2.6.33.y Linux kernel stable tree USB: uss720 fixup refcount position 2011-03-28T14:31:22+00:00 Peter Holik peter@holik.at 2011-03-18T17:47:44+00:00 a390e88f47af360091497d4c8e67420e04d54fdb commit adaa3c6342b249548ea830fe8e02aa5b45be8688 upstream. My testprog do a lot of bitbang - after hours i got following warning and my machine lockups: WARNING: at /build/buildd/linux-2.6.38/lib/kref.c:34 After debugging uss720 driver i discovered that the completion callback was called before usb_submit_urb returns. The callback frees the request structure that is krefed on return by usb_submit_urb. Signed-off-by: Peter Holik <peter@holik.at> Acked-by: Thomas Sailer <t.sailer@alumni.ethz.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit adaa3c6342b249548ea830fe8e02aa5b45be8688 upstream.

My testprog do a lot of bitbang - after hours i got following warning and my machine lockups:
WARNING: at /build/buildd/linux-2.6.38/lib/kref.c:34
After debugging uss720 driver i discovered that the completion callback was called before
usb_submit_urb returns. The callback frees the request structure that is krefed on return by
usb_submit_urb.

Signed-off-by: Peter Holik <peter@holik.at>
Acked-by: Thomas Sailer <t.sailer@alumni.ethz.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
usb: iowarrior: don't trust report_size for buffer size 2011-03-21T19:45:28+00:00 Kees Cook kees.cook@canonical.com 2010-10-11T18:28:16+00:00 6b85e439753bfb9e1665a9697df51600cb864c38 commit 3ed780117dbe5acb64280d218f0347f238dafed0 upstream. If the iowarrior devices in this case statement support more than 8 bytes per report, it is possible to write past the end of a kernel heap allocation. This will probably never be possible, but change the allocation to be more defensive anyway. Signed-off-by: Kees Cook <kees.cook@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Acked-by: Brandon Philips <bphilips@suse.de> 
commit 3ed780117dbe5acb64280d218f0347f238dafed0 upstream.

If the iowarrior devices in this case statement support more than 8 bytes
per report, it is possible to write past the end of a kernel heap allocation.
This will probably never be possible, but change the allocation to be more
defensive anyway.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Acked-by: Brandon Philips <bphilips@suse.de>
USB: misc: uss720.c: add another vendor/product ID 2011-03-21T19:44:30+00:00 Thomas Sailer t.sailer@alumni.ethz.ch 2010-12-14T15:04:05+00:00 2e3e89747b2a4fb4e85e8f5ec0388b9910fb67d2 commit ecc1624a2fff45780959efbcb73ace18fdb3c58d upstream. Fabio Battaglia report that he has another cable that works with this driver, so this patch adds its vendor/product ID. Signed-off-by: Thomas Sailer <t.sailer@alumni.ethz.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit ecc1624a2fff45780959efbcb73ace18fdb3c58d upstream.

Fabio Battaglia report that he has another cable that works with this
driver, so this patch adds its vendor/product ID.

Signed-off-by: Thomas Sailer <t.sailer@alumni.ethz.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
USB: misc: usbsevseg: fix up some sysfs attribute permissions 2011-03-21T19:44:04+00:00 Greg Kroah-Hartman gregkh@suse.de 2010-11-15T19:36:44+00:00 aa8bdc8721d399c32f26a597578c5bb777123511 commit e24d7ace4e822debcb78386bf279c9aba4d7fbd1 upstream. They should not be writable by any user. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Harrison Metzger <harrisonmetz@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit e24d7ace4e822debcb78386bf279c9aba4d7fbd1 upstream.

They should not be writable by any user.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Harrison Metzger <harrisonmetz@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
USB: misc: trancevibrator: fix up a sysfs attribute permission 2011-03-21T19:44:04+00:00 Greg Kroah-Hartman gregkh@suse.de 2010-11-15T19:34:26+00:00 f1f0a2db03038ad5eeae8e47b3aea030ac62ce17 commit d489a4b3926bad571d404ca6508f6744b9602776 upstream. It should not be writable by any user. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Sam Hocevar <sam@zoy.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit d489a4b3926bad571d404ca6508f6744b9602776 upstream.

It should not be writable by any user.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Sam Hocevar <sam@zoy.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
USB: misc: usbled: fix up some sysfs attribute permissions 2011-03-21T19:44:03+00:00 Greg Kroah-Hartman gregkh@suse.de 2010-11-15T19:35:49+00:00 967e5c6eb86a2ac562a62e142d36cdad451d36b0 commit 48f115470e68d443436b76b22dad63ffbffd6b97 upstream. They should not be writable by any user. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 48f115470e68d443436b76b22dad63ffbffd6b97 upstream.

They should not be writable by any user.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
USB: misc: cypress_cy7c63: fix up some sysfs attribute permissions 2011-03-21T19:44:03+00:00 Greg Kroah-Hartman gregkh@suse.de 2010-11-15T19:32:38+00:00 a154f54e15663e700edafbf953fecb01b8ca7765 commit c990600d340641150f7270470a64bd99a5c0b225 upstream. They should not be writable by any user. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Oliver Bock <bock@tfh-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit c990600d340641150f7270470a64bd99a5c0b225 upstream.

They should not be writable by any user.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oliver Bock <bock@tfh-berlin.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
usb: misc: iowarrior: fix information leak to userland 2011-03-21T19:44:00+00:00 Vasiliy Kulikov segooon@gmail.com 2010-11-06T14:41:31+00:00 d66dbddd744d6bd67258bbc89dc01b4704374ff2 commit eca67aaeebd6e5d22b0d991af1dd0424dc703bfb upstream. Structure iowarrior_info is copied to userland with padding byted between "serial" and "revision" fields uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Acked-by: Kees Cook <kees.cook@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit eca67aaeebd6e5d22b0d991af1dd0424dc703bfb upstream.

Structure iowarrior_info is copied to userland with padding byted
between "serial" and "revision" fields uninitialized.  It leads to
leaking of contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
usb: misc: sisusbvga: fix information leak to userland 2011-03-21T19:44:00+00:00 Vasiliy Kulikov segooon@gmail.com 2010-11-06T14:41:35+00:00 0bd0e38c333e5bb69921ece2ba1d9c3e2d237b42 commit 5dc92cf1d0b4b0debbd2e333b83f9746c103533d upstream. Structure sisusb_info is copied to userland with "sisusb_reserved" field uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 5dc92cf1d0b4b0debbd2e333b83f9746c103533d upstream.

Structure sisusb_info is copied to userland with "sisusb_reserved" field
uninitialized.  It leads to leaking of contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
USB: sisusbvga: Fix for USB 3.0 2010-08-02T17:26:43+00:00 Oliver Neukum oliver@neukum.org 2010-07-16T15:36:26+00:00 ccf2268a3f72322db0b880ce1bd1e0a9d0adddd9 commit 20a12f007feee1cfa761b431047271d1141d8031 upstream. Super speed is also fast enough to let sisusbvga operate. Therefor expand the checks. Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 20a12f007feee1cfa761b431047271d1141d8031 upstream.

Super speed is also fast enough to let sisusbvga operate.
Therefor expand the checks.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>