linux-stable.git/drivers/usb/misc, branch v4.19.48

USB: yurex: Fix protection fault after device removal

2019-05-08T05:21:43+00:00

commit ef61eb43ada6c1d6b94668f0f514e4c268093ff3 upstream.

The syzkaller USB fuzzer found a general-protection-fault bug in the
yurex driver.  The fault occurs when a device has been unplugged; the
driver's interrupt-URB handler logs an error message referring to the
device by name, after the device has been unregistered and its name
deallocated.

This problem is caused by the fact that the interrupt URB isn't
cancelled until the driver's private data structure is released, which
can happen long after the device is gone.  The cure is to make sure
that the interrupt URB is killed before yurex_disconnect() returns;
this is exactly the sort of thing that usb_poison_urb() was meant for.

Signed-off-by: Alan Stern 
Reported-and-tested-by: syzbot+2eb9121678bdb36e6d57@syzkaller.appspotmail.com
CC: 
Signed-off-by: Greg Kroah-Hartman

usb: usb251xb: fix to avoid potential NULL pointer dereference

2019-05-04T07:20:20+00:00

[ Upstream commit 41f00e6e9e55546390031996b773e7f3c1d95928 ]

of_match_device in usb251xb_probe can fail and returns a NULL pointer.
The patch avoids a potential NULL pointer dereference in this scenario.

Signed-off-by: Aditya Pakki 
Reviewed-by: Richard Leitner 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin (Microsoft)

usb: appledisplay: Add 27" Apple Cinema Display

2018-12-13T08:16:15+00:00

commit d7859905301880ad3e16272399d26900af3ac496 upstream.

Add another Apple Cinema Display to the list of supported displays.

Signed-off-by: Alexander Theissen 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

USB: misc: appledisplay: add 20" Apple Cinema Display

2018-11-27T15:13:10+00:00

commit f6501f49199097b99e4e263644d88c90d1ec1060 upstream.

Add another Apple Cinema Display to the list of supported displays

Signed-off-by: Mattias Jacobsson <2pi@mok.nu>
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usb: misc: uss720: Fix two sleep-in-atomic-context bugs

2018-09-05T12:36:53+00:00

async_complete() in uss720.c is a completion handler function for the
USB driver. So it should not sleep, but it is can sleep according to the
function call paths (from bottom to top) in Linux-4.16.

[FUNC] set_1284_register(GFP_KERNEL)
drivers/usb/misc/uss720.c, 372:
  set_1284_register in parport_uss720_frob_control
drivers/parport/ieee1284.c, 560:
  [FUNC_PTR]parport_uss720_frob_control in parport_ieee1284_ack_data_avail
drivers/parport/ieee1284.c, 577:
  parport_ieee1284_ack_data_avail in parport_ieee1284_interrupt
./include/linux/parport.h, 474:
  parport_ieee1284_interrupt in parport_generic_irq
drivers/usb/misc/uss720.c, 116:
  parport_generic_irq in async_complete

[FUNC] get_1284_register(GFP_KERNEL)
drivers/usb/misc/uss720.c, 382:
  get_1284_register in parport_uss720_read_status
drivers/parport/ieee1284.c, 555:
  [FUNC_PTR]parport_uss720_read_status in parport_ieee1284_ack_data_avail
drivers/parport/ieee1284.c, 577:
  parport_ieee1284_ack_data_avail in parport_ieee1284_interrupt
./include/linux/parport.h, 474:
  parport_ieee1284_interrupt in parport_generic_irq
drivers/usb/misc/uss720.c, 116:
  parport_generic_irq in async_complete

Note that [FUNC_PTR] means a function pointer call is used.

To fix these bugs, GFP_KERNEL is replaced with GFP_ATOMIC.

These bugs are found by my static analysis tool DSAC.

Signed-off-by: Jia-Ju Bai 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

USB: yurex: Check for truncation in yurex_read()

2018-09-05T11:27:06+00:00

snprintf() always returns the full length of the string it could have
printed, even if it was truncated because the buffer was too small.
So in case the counter value is truncated, we will over-read from
in_buffer and over-write to the caller's buffer.

I don't think it's actually possible for this to happen, but in case
truncation occurs, WARN and return -EIO.

Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

USB: yurex: Fix buffer over-read in yurex_write()

2018-09-05T11:27:06+00:00

If the written data starts with a digit, yurex_write() tries to parse
it as an integer using simple_strtoull().  This requires a null-
terminator, and currently there's no guarantee that there is one.

(The sample program at
https://github.com/NeoCat/YUREX-driver-for-Linux/blob/master/sample/yurex_clock.pl
writes an integer without a null terminator.  It seems like it must
have worked by chance!)

Always add a null byte after the written data.  Enlarge the buffer
to allow for this.

Cc: stable@vger.kernel.org
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

Merge 4.18-rc5 into usb-next

2018-07-16T07:09:24+00:00

We need the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman

usb-misc: sisusbvga: remove redundant variable modey

2018-07-13T13:41:56+00:00

Variable modey is being assigned but is never used hence it is
redundant and can be removed.

Cleans up clang warning:
warning: variable 'modey' set but not used [-Wunused-but-set-variable]

Signed-off-by: Colin Ian King 
Signed-off-by: Greg Kroah-Hartman

usb: misc: uss720: remove redundant pointer usbdev

2018-07-13T13:41:55+00:00

Pointer usbdev is being assigned but is never used hence it is
redundant and can be removed.

Cleans up clang warning:
warning: variable 'usbdev' set but not used [-Wunused-but-set-variable]

Signed-off-by: Colin Ian King 
Signed-off-by: Greg Kroah-Hartman