linux-stable.git/drivers/usb/serial, branch v3.18.4

USB: console: fix potential use after free

2015-01-27T16:29:43+00:00

commit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream.

Use tty kref to release the fake tty in usb_console_setup to avoid use
after free if the underlying serial driver has acquired a reference.

Note that using the tty destructor release_one_tty requires some more
state to be initialised.

Fixes: 4a90f09b20f4 ("tty: usb-serial krefs")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: console: fix uninitialised ldisc semaphore

2015-01-27T16:29:43+00:00

commit d269d4434c72ed0da3a9b1230c30da82c4918c63 upstream.

The USB console currently allocates a temporary fake tty which is used
to pass terminal settings to the underlying serial driver.

The tty struct is not fully initialised, something which can lead to a
lockdep warning (or worse) if a serial driver tries to acquire a
line-discipline reference:

	usbserial: USB Serial support registered for pl2303
	pl2303 1-2.1:1.0: pl2303 converter detected
	usb 1-2.1: pl2303 converter now attached to ttyUSB0
	INFO: trying to register non-static key.
	the code is fine but needs lockdep annotation.
	turning off the locking correctness validator.
	CPU: 0 PID: 68 Comm: udevd Tainted: G        W      3.18.0-rc5 #10
	[] (unwind_backtrace) from [] (show_stack+0x20/0x24)
	[] (show_stack) from [] (dump_stack+0x24/0x28)
	[] (dump_stack) from [] (__lock_acquire+0x1e50/0x2004)
	[] (__lock_acquire) from [] (lock_acquire+0xe4/0x18c)
	[] (lock_acquire) from [] (ldsem_down_read_trylock+0x78/0x90)
	[] (ldsem_down_read_trylock) from [] (tty_ldisc_ref+0x24/0x58)
	[] (tty_ldisc_ref) from [] (usb_serial_handle_dcd_change+0x48/0xe8)
	[] (usb_serial_handle_dcd_change) from [] (pl2303_read_int_callback+0x210/0x220 [pl2303])
	[] (pl2303_read_int_callback [pl2303]) from [] (__usb_hcd_giveback_urb+0x80/0x140)
	[] (__usb_hcd_giveback_urb) from [] (usb_giveback_urb_bh+0x98/0xd4)
	[] (usb_giveback_urb_bh) from [] (tasklet_hi_action+0x9c/0x108)
	[] (tasklet_hi_action) from [] (__do_softirq+0x148/0x42c)
	[] (__do_softirq) from [] (irq_exit+0xd8/0x114)
	[] (irq_exit) from [] (__handle_domain_irq+0x84/0xdc)
	[] (__handle_domain_irq) from [] (omap_intc_handle_irq+0xd8/0xe0)
	[] (omap_intc_handle_irq) from [] (__irq_svc+0x44/0x7c)
	Exception stack(0xdf4e7f08 to 0xdf4e7f50)
	7f00:                   debc0b80 df4e7f5c 00000000 00000000 debc0b80 be8da96c
	7f20: 00000000 00000128 c000fc84 df4e6000 00000000 df4e7f94 00000004 df4e7f50
	7f40: c038ebc0 c038d74c 600f0013 ffffffff
	[] (__irq_svc) from [] (___sys_sendmsg.part.29+0x0/0x2e0)
	[] (___sys_sendmsg.part.29) from [] (SyS_sendmsg+0x18/0x1c)
	[] (SyS_sendmsg) from [] (ret_fast_syscall+0x0/0x48)
	console [ttyUSB0] enabled

Fixes: 36697529b5bb ("tty: Replace ldisc locking with ldisc_sem")
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: keyspan: fix null-deref at probe

2015-01-27T16:29:42+00:00

commit b5122236bba8d7ef62153da5b55cc65d0944c61e upstream.

Fix null-pointer dereference during probe if the interface-status
completion handler is called before the individual ports have been set
up.

Fixes: f79b2d0fe81e ("USB: keyspan: fix NULL-pointer dereferences and
memory leaks")
Reported-by: Richard 
Tested-by: Richard 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: qcserial/option: make AT URCs work for Sierra Wireless MC73xx

2015-01-27T16:29:42+00:00

commit d80c0d14183516f184a5ac88e11008ee4c7d2a2e upstream.

As has been discussed in the thread starting with
https://lkml.kernel.org/g/549748e9.d+SiJzqu50f1r4lSAL043YSc@arcor.de
Sierra Wireless MC73xx devices with USB VID/PID 0x1199:0x68c0 require the
option_send_setup() code to be used on the USB interface for the AT port
to make unsolicited response codes work correctly. Move these devices from
the qcserial driver where they have been added by commit
70a3615fc07c2330ed7c1e922f3c44f4a67c0762 ("usb: qcserial: add Sierra Wireless
MC73xx") to the option driver and add a MC73xx-specific blacklist
to ensure that
1. the sendsetup code is not used for the DIAG/DM and NMEA interfaces
2. the option driver does not attach to the QMI/network interfaces

Signed-off-by: Reinhard Speyerer 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices

2015-01-27T16:29:42+00:00

commit 1ae78a4870989a354028cb17dabf819b595e70e3 upstream.

Added virtual com port VID/PID entries for CEL USB sticks and MeshWorks
devices.

Signed-off-by: David Peterson 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: cp210x: fix ID for production CEL MeshConnect USB Stick

2015-01-27T16:29:42+00:00

commit 90441b4dbe90ba0c38111ea89fa093a8c9627801 upstream.

Fixing typo for MeshConnect IDs. The original PID (0x8875) is not in
production and is not needed. Instead it has been changed to the
official production PID (0x8857).

Signed-off-by: Preston Fick 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: qcserial: Add support for HP lt4112 LTE/HSPA+ Gobi 4G Modem

2015-01-16T14:59:52+00:00

commit e7181d005e84b15fe3121a8d22840adc3395d496 upstream.

Added new device layout "DEVICE_HWI" and also added the USB VID/PID for the
HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e)

Signed-off-by: Martin Hauke 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: ssu100: fix overrun-error reporting

2014-11-19T15:22:22+00:00

Fix reporting of overrun errors, which should only be reported once
using the inserted null character.

Fixes: 6b8f1ca5581b ("USB: ssu100: set tty_flags in ssu100_process_packet")
Cc: stable 
Signed-off-by: Johan Hovold

USB: keyspan: fix overrun-error reporting

2014-11-19T15:22:22+00:00

Fix reporting of overrun errors, which are not associated with a
character. Instead insert a null character and report only once.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable 
Signed-off-by: Johan Hovold

USB: keyspan: fix tty line-status reporting

2014-11-19T15:22:21+00:00

Fix handling of TTY error flags, which are not bitmasks and must
specifically not be ORed together as this prevents the line discipline
from recognising them.

Also insert null characters when reporting overrun errors as these are
not associated with the received character.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable 
Signed-off-by: Johan Hovold