linux-stable.git/drivers/usb/usbip/stub_dev.c, branch linux-3.18.y

usbip: usbip_host: fix NULL-ptr deref and use-after-free errors

2018-05-25T08:54:53+00:00

commit 22076557b07c12086eeb16b8ce2b0b735f7a27e7 upstream.

usbip_host updates device status without holding lock from stub probe,
disconnect and rebind code paths. When multiple requests to import a
device are received, these unprotected code paths step all over each
other and drive fails with NULL-ptr deref and use-after-free errors.

The driver uses a table lock to protect the busid array for adding and
deleting busids to the table. However, the probe, disconnect and rebind
paths get the busid table entry and update the status without holding
the busid table lock. Add a new finer grain lock to protect the busid
entry. This new lock will be held to search and update the busid entry
fields from get_busid_idx(), add_match_busid() and del_match_busid().

match_busid_show() does the same to access the busid entry fields.

get_busid_priv() changed to return the pointer to the busid entry holding
the busid lock. stub_probe(), stub_disconnect() and stub_device_rebind()
call put_busid_priv() to release the busid lock before returning. This
changes fixes the unprotected code paths eliminating the race conditions
in updating the busid entries.

Reported-by: Jakub Jirasek
Signed-off-by: Shuah Khan (Samsung OSG) 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: fix error handling in stub_probe()

2018-05-25T08:54:53+00:00

commit 3ff67445750a84de67faaf52c6e1895cb09f2c56 upstream.

If usb_hub_claim_port() fails, no resources are deallocated and
if stub_add_files() fails, port is not released.

The patch fixes these issues and rearranges error handling code.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Acked-by: Valentina Manea 
Signed-off-by: Greg Kroah-Hartman

usbip: usbip_host: run rebind from exit when module is removed

2018-05-25T08:54:53+00:00

commit 7510df3f29d44685bab7b1918b61a8ccd57126a9 upstream.

After removing usbip_host module, devices it releases are left without
a driver. For example, when a keyboard or a mass storage device are
bound to usbip_host when it is removed, these devices are no longer
bound to any driver.

Fix it to run device_attach() from the module exit routine to restore
the devices to their original drivers. This includes cleanup changes
and moving device_attach() code to a common routine to be called from
rebind_store() and usbip_host_exit().

Signed-off-by: Shuah Khan (Samsung OSG) 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: usbip_host: refine probe and disconnect debug msgs to be useful

2018-05-25T08:54:53+00:00

commit 28b68acc4a88dcf91fd1dcf2577371dc9bf574cc upstream.

Refine probe and disconnect debug msgs to be useful and say what is
in progress.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: keep usbip_device sockfd state in sync with tcp_socket

2018-02-25T10:01:19+00:00

commit 009f41aed4b3e11e6dc1e3c07377a10c20f1a5ed upstream.

Keep usbip_device sockfd state in sync with tcp_socket. When tcp_socket
is reset to null, reset sockfd to -1 to keep it in sync.

Signed-off-by: Shuah Khan 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

usbip: prevent leaking socket pointer address in messages

2018-02-16T19:14:43+00:00

commit 90120d15f4c397272aaf41077960a157fc4212bf upstream.

usbip driver is leaking socket pointer address in messages. Remove
the messages that aren't useful and print sockfd in the ones that
are useful for debugging.

Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

usbip: remove struct usb_device_id table

2014-08-25T17:40:58+00:00

This was used back when usbip-host was an interface device driver;
after the conversion to device driver, the table remained unused.
Remove it in order to stop receiving a warning about it.

Signed-off-by: Valentina Manea 
Signed-off-by: Greg Kroah-Hartman

usbip: move usbip kernel code out of staging

2014-08-25T17:40:06+00:00

At this point, USB/IP kernel code is fully functional
and can be moved out of staging.

Signed-off-by: Valentina Manea 
Signed-off-by: Greg Kroah-Hartman