linux-stable.git/drivers/usb/misc, branch v3.16.35

USB: iowarrior: fix oops with malicious USB descriptors

2016-03-29T14:56:13+00:00

commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream.

The iowarrior driver expects at least one valid endpoint.  If given
malicious descriptors that specify 0 for the number of endpoints,
it will crash in the probe function.  Ensure there is at least
one endpoint on the interface before using it.

The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87

Reported-by: Ralf Spenneberg 
Signed-off-by: Josh Boyer 
Signed-off-by: Greg Kroah-Hartman 
Cc: Moritz Muehlenhoff 
Signed-off-by: Luis Henriques

USB: adutux: NULL dereferences on disconnect

2015-02-04T10:58:29+00:00

commit fc625960edecfb57e62c2975d1f155155e28e6ba upstream.

Both "dev->udev" and "interface->dev" are NULL.  These printks are not
very interesting so I just deleted them.

Fixes: 03270634e242 ('USB: Add ADU support for Ontrak ADU devices')
Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Luis Henriques

USB: sisusb: add device id for Magic Control USB video

2014-10-05T20:40:57+00:00

commit 5b6b80aeb21091ed3030b9b6aae597d81326f1aa upstream.

I have a j5 create (JUA210) USB 2 video device and adding it device id
to SIS USB video gets it to work.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Greg Kroah-Hartman

USB: usbtest: add a timeout for scatter-gather tests

2014-06-18T00:05:50+00:00

In usbtest, tests 5 - 8 use the scatter-gather library in usbcore
without any sort of timeout.  If there's a problem in the gadget or
host controller being tested, the test can hang.

This patch adds a 10-second timeout to the tests, so that they will
fail gracefully with an ETIMEDOUT error instead of hanging.

Signed-off-by: Alan Stern 
Reported-by: Huang Rui 
Tested-by: Huang Rui 
CC: 
Signed-off-by: Greg Kroah-Hartman

usb: usbtest: add pattern check on pipe in phase of unlink read

2014-05-27T23:23:43+00:00

TEST 11 unlinks the URB read request for N times. When host and gadget
both initialize pattern 1 (mod 63) data series to do IN transfer, the
host side function should check the data buffer if it is as mod 63
series, because the data packet which host receivced will follow
pattern 1. So this patch adds this checking action.

Signed-off-by: Huang Rui 
Signed-off-by: Greg Kroah-Hartman

usb: usbtest: fix unlink write error with pattern 1

2014-05-27T23:23:43+00:00

TEST 12 and TEST 24 unlinks the URB write request for N times. When
host and gadget both initialize pattern 1 (mod 63) data series to
transfer, the gadget side will complain the wrong data which is not
expected.  Because in host side, usbtest doesn't fill the data buffer
as mod 63 and this patch fixed it.

[20285.488974] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
[20285.489181] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
[20285.489423] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb50800 length 512 last
[20285.489727] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
[20285.490055] dwc3 dwc3.0.auto: Command Complete --> 0
[20285.490281] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
[20285.490492] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Active
[20285.490713] dwc3 dwc3.0.auto: ep1out-bulk: endpoint busy
[20285.490909] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Complete
[20285.491117] dwc3 dwc3.0.auto: request ffff8800aa6cb480 from ep1out-bulk completed 512/512 ===> 0
[20285.491431] zero gadget: bad OUT byte, buf[1] = 0
[20285.491605] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Set Stall' params 00000000 00000000 00000000
[20285.491915] dwc3 dwc3.0.auto: Command Complete --> 0
[20285.492099] dwc3 dwc3.0.auto: queing request ffff8800aa6cb480 to ep1out-bulk length 512
[20285.492387] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
[20285.492595] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
[20285.492830] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb51000 length 512 last
[20285.493135] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
[20285.493465] dwc3 dwc3.0.auto: Command Complete --> 0

Cc: 
Signed-off-by: Huang Rui 
Signed-off-by: Greg Kroah-Hartman

usb: usb5303: add support for reference clock specified in device tree

2014-05-27T23:19:04+00:00

USB3503 chip supports 8 values of reference clock. The value is
specified by REF_SEL[1:0] pins and INT_N line. This patch add support
for getting 'refclk' clock, enabling it and setting INT_N line according
to the value of the gathered clock. If no clock has been specified,
driver defaults to the old behaviour (assuming that clock has been
specified by REF_SEL pins from primary reference clock frequencies
table).

Signed-off-by: Marek Szyprowski 
Signed-off-by: Greg Kroah-Hartman

USB: yurex: fix race between probe() and read()

2014-05-27T23:03:58+00:00

There's a window during which read() would return 0 instead
of a correct error for no data yet. Reorder initialization
to fix the race.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

USB: appledisplay: fix race between reading and writing from the device

2014-05-27T23:03:57+00:00

The workqueue handler may call appledisplay_bl_get_brightness() while
user space calls appledisplay_bl_update_status(). As they share a
buffer that must not happen. Use a mutex for mutual exclusion.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

USB: iowarrior: Convert local dbg macro to dev_dbg

2014-05-27T22:00:22+00:00

Use a more standard logging style.

Add terminating newlines to formats.
Remove __func__ as that can be added via dynamic debug.
Remove now unnecessary debug module parameter.
Remove the dbg macro too.

Signed-off-by: Joe Perches 
Signed-off-by: Greg Kroah-Hartman