linux-stable.git/drivers/usb/misc, branch v3.18.52

USB: idmouse: fix NULL-deref at probe

2017-04-18T05:55:53+00:00

commit b0addd3fa6bcd119be9428996d5d4522479ab240 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: lvtest: fix NULL-deref at probe

2017-04-18T05:55:53+00:00

commit 1dc56c52d2484be09c7398a5207d6b11a4256be9 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should the probed device lack endpoints.

Note that this driver does not bind to any devices by default.

Fixes: ce21bfe603b3 ("USB: Add LVS Test device driver")
Cc: Pratyush Anand 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: uss720: fix NULL-deref at probe

2017-04-18T05:55:53+00:00

commit f259ca3eed6e4b79ac3d5c5c9fb259fb46e86217 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Note that the endpoint access that causes the NULL-deref is currently
only used for debugging purposes during probe so the oops only happens
when dynamic debugging is enabled. This means the driver could be
rewritten to continue to accept device with only two endpoints, should
such devices exist.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: iowarrior: fix NULL-deref in write

2017-04-18T05:55:50+00:00

commit de46e56653de7b3b54baa625bd582635008b8d05 upstream.

Make sure to verify that we have the required interrupt-out endpoint for
IOWarrior56 devices to avoid dereferencing a NULL-pointer in write
should a malicious device lack such an endpoint.

Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: iowarrior: fix NULL-deref at probe

2017-04-18T05:55:50+00:00

commit b7321e81fc369abe353cf094d4f0dc2fe11ab95f upstream.

Make sure to check for the required interrupt-in endpoint to avoid
dereferencing a NULL-pointer should a malicious device lack such an
endpoint.

Note that a fairly recent change purported to fix this issue, but added
an insufficient test on the number of endpoints only, a test which can
now be removed.

Fixes: 4ec0ef3a8212 ("USB: iowarrior: fix oops with malicious USB descriptors")
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

usb: misc: usbtest: add fix for driver hang

2016-09-01T02:05:44+00:00

[ Upstream commit 539587511835ea12d8daa444cbed766cf2bc3612 ]

In sg_timeout(), req->status is set to "-ETIMEDOUT" before calling
into usb_sg_cancel(). usb_sg_cancel() will do nothing and return
directly if req->status has been set to a non-zero value. This will
cause driver hang whenever transfer time out is triggered.

This patch fixes this issue. It could be backported to stable kernel
with version later than v3.15.

Cc: stable@vger.kernel.org # 3.15+
Cc: Alan Stern 
Signed-off-by: Lu Baolu 
Suggested-by: Alan Stern 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usb: misc: usbtest: fix pattern tests for scatterlists.

2016-06-03T15:30:33+00:00

[ Upstream commit cdc77c82a8286b1181b81b6e5ef60c8e83ded7bc ]

The current implemenentation restart the sent pattern for each entry in
the sg list. The receiving end expects a continuous pattern, and test
will fail unless scatterilst entries happen to be aligned with the
pattern

Fix this by calculating the pattern byte based on total sent size
instead of just the current sg entry.

Signed-off-by: Mathias Nyman 
Fixes: 8b5249019352 ("[PATCH] USB: usbtest: scatterlist OUT data pattern testing")
Cc:  # v2.6.18+
Acked-by: Felipe Balbi 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usb: misc: usbtest: format the data pattern according to max packet size

2016-06-03T15:30:33+00:00

[ Upstream commit b9a6e8e1001e28fecbd74c073f5503dac2790563 ]

With this change, the host and gadget doesn't need to agree with transfer
length for comparing the data, since they doesn't know each other's
transfer size, but know max packet size.

Signed-off-by: Peter Chen 
Acked-by: Michal Nazarewicz 
(Fixed the 'line over 80 characters warning' by Peter Chen)
Tested-by: Peter Chen 
Signed-off-by: Alan Stern 
Signed-off-by: Felipe Balbi 

Signed-off-by: Sasha Levin

USB: iowarrior: fix oops with malicious USB descriptors

2016-04-18T12:49:35+00:00

[ Upstream commit 4ec0ef3a82125efc36173062a50624550a900ae0 ]

The iowarrior driver expects at least one valid endpoint.  If given
malicious descriptors that specify 0 for the number of endpoints,
it will crash in the probe function.  Ensure there is at least
one endpoint on the interface before using it.

The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87

Reported-by: Ralf Spenneberg 
Cc: stable 
Signed-off-by: Josh Boyer 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usb: rename phy to usb_phy in HCD

2014-09-29T15:52:59+00:00

The USB PHY member of the HCD structure is renamed to 'usb_phy' and
modifications are done in all drivers accessing it.
This is in preparation to adding the generic PHY support.

Signed-off-by: Antoine Tenart 
[Sergei: added missing 'drivers/usb/misc/lvstest.c' file, resolved rejects,
updated changelog.]
Signed-off-by: Sergei Shtylyov 
Acked-by: Alan Stern 
Acked-by: Felipe Balbi 
Signed-off-by: Greg Kroah-Hartman