linux-stable.git/drivers/usb/misc, branch linux-3.14.y Linux kernel stable tree USB: iowarrior: fix oops with malicious USB descriptors 2016-04-12T16:12:40+00:00 Josh Boyer jwboyer@fedoraproject.org 2016-03-14T14:42:38+00:00 1c882bf53cdfd264f90d2a4cfac510321df7a73f commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream. The iowarrior driver expects at least one valid endpoint. If given malicious descriptors that specify 0 for the number of endpoints, it will crash in the probe function. Ensure there is at least one endpoint on the interface before using it. The full report of this issue can be found here: http://seclists.org/bugtraq/2016/Mar/87 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream.

The iowarrior driver expects at least one valid endpoint.  If given
malicious descriptors that specify 0 for the number of endpoints,
it will crash in the probe function.  Ensure there is at least
one endpoint on the interface before using it.

The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: sisusb: add device id for Magic Control USB video 2014-10-05T21:52:13+00:00 Stephen Hemminger stephen@networkplumber.org 2014-08-26T04:07:47+00:00 61fd69fcfa96cbe4d2923036870b0fac826d0db8 commit 5b6b80aeb21091ed3030b9b6aae597d81326f1aa upstream. I have a j5 create (JUA210) USB 2 video device and adding it device id to SIS USB video gets it to work. Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 5b6b80aeb21091ed3030b9b6aae597d81326f1aa upstream.

I have a j5 create (JUA210) USB 2 video device and adding it device id
to SIS USB video gets it to work.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: usbtest: add a timeout for scatter-gather tests 2014-07-01T03:11:52+00:00 Alan Stern stern@rowland.harvard.edu 2014-06-03T15:11:34+00:00 fe6fa2465e83ce6aea2fc7d146638e69b0438b90 commit 32b36eeae6a859670d2939a7d6136cb5e9ed64f8 upstream. In usbtest, tests 5 - 8 use the scatter-gather library in usbcore without any sort of timeout. If there's a problem in the gadget or host controller being tested, the test can hang. This patch adds a 10-second timeout to the tests, so that they will fail gracefully with an ETIMEDOUT error instead of hanging. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-by: Huang Rui <ray.huang@amd.com> Tested-by: Huang Rui <ray.huang@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 32b36eeae6a859670d2939a7d6136cb5e9ed64f8 upstream.

In usbtest, tests 5 - 8 use the scatter-gather library in usbcore
without any sort of timeout.  If there's a problem in the gadget or
host controller being tested, the test can hang.

This patch adds a 10-second timeout to the tests, so that they will
fail gracefully with an ETIMEDOUT error instead of hanging.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Huang Rui <ray.huang@amd.com>
Tested-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: usbtest: fix unlink write error with pattern 1 2014-07-01T03:11:52+00:00 Huang Rui ray.huang@amd.com 2014-05-26T02:55:36+00:00 08dbc4287663f92fa69556a0074076312e64a8e5 commit e4d58f5dcb7d7be45df8def31881ebfae99c75da upstream. TEST 12 and TEST 24 unlinks the URB write request for N times. When host and gadget both initialize pattern 1 (mod 63) data series to transfer, the gadget side will complain the wrong data which is not expected. Because in host side, usbtest doesn't fill the data buffer as mod 63 and this patch fixed it. [20285.488974] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready [20285.489181] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active [20285.489423] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb50800 length 512 last [20285.489727] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000 [20285.490055] dwc3 dwc3.0.auto: Command Complete --> 0 [20285.490281] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready [20285.490492] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Active [20285.490713] dwc3 dwc3.0.auto: ep1out-bulk: endpoint busy [20285.490909] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Complete [20285.491117] dwc3 dwc3.0.auto: request ffff8800aa6cb480 from ep1out-bulk completed 512/512 ===> 0 [20285.491431] zero gadget: bad OUT byte, buf[1] = 0 [20285.491605] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Set Stall' params 00000000 00000000 00000000 [20285.491915] dwc3 dwc3.0.auto: Command Complete --> 0 [20285.492099] dwc3 dwc3.0.auto: queing request ffff8800aa6cb480 to ep1out-bulk length 512 [20285.492387] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready [20285.492595] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active [20285.492830] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb51000 length 512 last [20285.493135] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000 [20285.493465] dwc3 dwc3.0.auto: Command Complete --> 0 Signed-off-by: Huang Rui <ray.huang@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit e4d58f5dcb7d7be45df8def31881ebfae99c75da upstream.

TEST 12 and TEST 24 unlinks the URB write request for N times. When
host and gadget both initialize pattern 1 (mod 63) data series to
transfer, the gadget side will complain the wrong data which is not
expected.  Because in host side, usbtest doesn't fill the data buffer
as mod 63 and this patch fixed it.

[20285.488974] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
[20285.489181] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
[20285.489423] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb50800 length 512 last
[20285.489727] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
[20285.490055] dwc3 dwc3.0.auto: Command Complete --> 0
[20285.490281] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
[20285.490492] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Active
[20285.490713] dwc3 dwc3.0.auto: ep1out-bulk: endpoint busy
[20285.490909] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Complete
[20285.491117] dwc3 dwc3.0.auto: request ffff8800aa6cb480 from ep1out-bulk completed 512/512 ===> 0
[20285.491431] zero gadget: bad OUT byte, buf[1] = 0
[20285.491605] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Set Stall' params 00000000 00000000 00000000
[20285.491915] dwc3 dwc3.0.auto: Command Complete --> 0
[20285.492099] dwc3 dwc3.0.auto: queing request ffff8800aa6cb480 to ep1out-bulk length 512
[20285.492387] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
[20285.492595] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
[20285.492830] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb51000 length 512 last
[20285.493135] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
[20285.493465] dwc3 dwc3.0.auto: Command Complete --> 0

Signed-off-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: delete non-required instances of include <linux/init.h> 2014-01-08T23:01:39+00:00 Paul Gortmaker paul.gortmaker@windriver.com 2014-01-08T16:08:26+00:00 803a536243b3a1ed2289f41897b11b72bd083309 None of these files are actually using any __init type directives and hence don't need to include <linux/init.h>. Most are just a left over from __devinit and __cpuinit removal, or simply due to code getting copied from one driver to the next. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
None of these files are actually using any __init type directives
and hence don't need to include <linux/init.h>.  Most are just a
left over from __devinit and __cpuinit removal, or simply due to
code getting copied from one driver to the next.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: misc: idmouse: correct spelling mistake in error string 2014-01-03T20:39:31+00:00 Rahul Bedarkar rahulbedarkar89@gmail.com 2014-01-02T13:55:50+00:00 45868b3a98605172ebe6367f602dca347e1d2904 Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: yurex: fix spelling mistake in comment 2014-01-03T20:37:57+00:00 Rahul Bedarkar rahulbedarkar89@gmail.com 2013-12-30T15:19:19+00:00 3fb4c07a52d7d0bf7d880538c11629e69fc8be2e fix spelling mistake in comment Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
fix spelling mistake in comment

Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: iowarrior: fix spelling mistake in comment 2014-01-03T20:37:57+00:00 Rahul Bedarkar rahulbedarkar89@gmail.com 2013-12-30T14:30:54+00:00 f38f1418f9efb4d7b1fe20ca9de16679271a3705 Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge tag 'for-usb-next-2013-12-20' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-next 2013-12-21T23:58:40+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2013-12-21T23:58:40+00:00 e2a3a64855f2f906e0ba9056a3a57aeb73b1a968 Sarah writes: xhci: Cleanups, non-urgent fixes for 3.14. Happy Holidays, Greg! Here's four patches to be queued to usb-next for 3.14. One adds a module parameter to the xHCI driver to allow users to enable xHCI quirks without recompiling their kernel, which you've already said is fine. The second patch is a bug fix for new usbtest code that's only in usb-next. The third patch is simple cleanup. The last patch is a non-urgent bug fix for xHCI platform devices. The bug has been in the code since 3.9. You've been asking me to hold off on non-urgent bug fixes after -rc4/-rc5, so it can go into usb-next, and be backported to stable once 3.14 is out. These have all been tested over the past week. I did run across one oops, but it turned out to be a bug in 3.12, and therefore not related to any of these patches. Please queue these for usb-next and 3.14. Thanks, Sarah Sharp 
Sarah writes:

xhci: Cleanups, non-urgent fixes for 3.14.

Happy Holidays, Greg!

Here's four patches to be queued to usb-next for 3.14.

One adds a module parameter to the xHCI driver to allow users to enable
xHCI quirks without recompiling their kernel, which you've already said
is fine.  The second patch is a bug fix for new usbtest code that's only
in usb-next.  The third patch is simple cleanup.

The last patch is a non-urgent bug fix for xHCI platform devices.  The
bug has been in the code since 3.9.  You've been asking me to hold off
on non-urgent bug fixes after -rc4/-rc5, so it can go into usb-next, and
be backported to stable once 3.14 is out.

These have all been tested over the past week.  I did run across one
oops, but it turned out to be a bug in 3.12, and therefore not related
to any of these patches.

Please queue these for usb-next and 3.14.

Thanks,
Sarah Sharp
drivers: usb: Mark function as static in usbsevseg.c 2013-12-19T18:23:12+00:00 Rashika Kheria rashika.kheria@gmail.com 2013-12-19T10:12:03+00:00 ff4708e69a633912c5c8e055fc399bf356d7a784 Mark function my_memlen() as static in misc/usbsevseg.c because it is not used outside this file. This eliminates the following warning in misc/usbsevseg.c: drivers/usb/misc/usbsevseg.c:60:15: warning: no previous prototype for ‘my_memlen’ [-Wmissing-prototypes] Signed-off-by: Rashika Kheria <rashika.kheria@gmail.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Mark function my_memlen() as static in misc/usbsevseg.c because it is
not used outside this file.

This eliminates the following warning in misc/usbsevseg.c:
drivers/usb/misc/usbsevseg.c:60:15: warning: no previous prototype for ‘my_memlen’ [-Wmissing-prototypes]

Signed-off-by: Rashika Kheria <rashika.kheria@gmail.com>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>