linux-stable.git/drivers/usb/wusbcore, branch linux-3.2.y

USB: wusbcore: fix NULL-deref at probe

2017-07-18T17:38:32+00:00

commit 03ace948a4eb89d1cf51c06afdfc41ebca5fdb27 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

This specifically fixes the NULL-pointer dereference when probing HWA HC
devices.

Fixes: df3654236e31 ("wusb: add the Wire Adapter (WA) core")
Cc: Inaky Perez-Gonzalez 
Cc: David Vrabel 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

usb: wusbcore: change WA_SEGS_MAX to a legal value

2014-01-03T04:33:16+00:00

commit f74b75e7f920c700636cccca669c7d16d12e9202 upstream.

change WA_SEGS_MAX to a number that is legal according to the WUSB
spec.

Signed-off-by: Thomas Pugliese 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

usb: wusbcore: set the RPIPE wMaxPacketSize value correctly

2014-01-03T04:33:15+00:00

commit 7b6bc07ab554e929c85d51b3d5b26cf7f12c6a3b upstream.

For isochronous endpoints, set the RPIPE wMaxPacketSize value using
wOverTheAirPacketSize from the endpoint companion descriptor instead of
wMaxPacketSize from the normal endpoint descriptor.

Signed-off-by: Thomas Pugliese 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

usb: Add export.h for EXPORT_SYMBOL/THIS_MODULE where needed

2011-10-31T23:31:25+00:00

With module.h being implicitly everywhere via device.h, the absence
of explicitly including something for EXPORT_SYMBOL went unnoticed.
Since we are heading to fix things up and clean module.h from the
device.h file, we need to explicitly include these files now.

Use the lightweight version of the header that has just THIS_MODULE
and EXPORT_SYMBOL variants.

Signed-off-by: Paul Gortmaker

usb: Add module.h to drivers/usb consumers who really use it.

2011-10-31T23:31:25+00:00

The situation up to this point meant that module.h was pretty
much everywhere, regardless of whether you asked for it or not.
We are fixing that, so give the USB folks who want it an actual
include of it.

Signed-off-by: Paul Gortmaker

USB: use usb_endpoint_maxp() instead of le16_to_cpu()

2011-08-23T16:47:40+00:00

Now ${LINUX}/drivers/usb/* can use usb_endpoint_maxp(desc) to get maximum packet size
instead of le16_to_cpu(desc->wMaxPacketSize).
This patch fix it up

Cc: Armin Fuerst 
Cc: Pavel Machek 
Cc: Johannes Erdfelt 
Cc: Vojtech Pavlik 
Cc: Oliver Neukum 
Cc: David Kubicek 
Cc: Johan Hovold 
Cc: Brad Hards 
Acked-by: Felipe Balbi 
Cc: Sebastian Andrzej Siewior 
Cc: Thomas Dahlmann 
Cc: David Brownell 
Cc: David Lopo 
Cc: Alan Stern 
Cc: Michal Nazarewicz 
Cc: Xie Xiaobo 
Cc: Li Yang 
Cc: Jiang Bo 
Cc: Yuan-hsin Chen 
Cc: Darius Augulis 
Cc: Xiaochen Shen 
Cc: Yoshihiro Shimoda 
Cc: OKI SEMICONDUCTOR, 
Cc: Robert Jarzmik 
Cc: Ben Dooks 
Cc: Thomas Abraham 
Cc: Herbert Pötzl 
Cc: Arnaud Patard 
Cc: Roman Weissgaerber 
Acked-by: Sarah Sharp 
Cc: Tony Olech 
Cc: Florian Floe Echtler 
Cc: Christian Lucht 
Cc: Juergen Stuber 
Cc: Georges Toth 
Cc: Bill Ryder 
Cc: Kuba Ober 
Cc: Inaky Perez-Gonzalez 
Signed-off-by: Kuninori Morimoto 
Signed-off-by: Greg Kroah-Hartman

atomic: use

2011-07-26T23:49:47+00:00

This allows us to move duplicated code in 
(atomic_inc_not_zero() for now) to 

Signed-off-by: Arun Sharma 
Reviewed-by: Eric Dumazet 
Cc: Ingo Molnar 
Cc: David Miller 
Cc: Eric Dumazet 
Acked-by: Mike Frysinger 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

wusb: use printk_ratelimited() instead of printk_ratelimit()

2011-07-01T21:43:25+00:00

Since printk_ratelimit() shouldn't be used anymore (see comment in
include/linux/printk.h), replace it with printk_ratelimited()

Signed-off-by: Manuel Zerpies 
Signed-off-by: Greg Kroah-Hartman

USB: wusbcore: return negative error codes

2011-06-07T16:09:10+00:00

cbaf_cdid_get() is only used in cbaf_wusb_chid_store().

In the original code cbaf_cdid_get() returns either a negative error
code or a small positive value on error.  I have changed it to
return -ENOENT if there is not enough data available.

In the original code the caller changed the negative error codes to
positive return values.  I've changed it to just return the error
value directly.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Fix common misspellings

2011-03-31T14:26:23+00:00

Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi