linux-stable.git/drivers/usb/wusbcore, branch linux-4.9.y

usb: wusbcore: security: cast sizeof to int for comparison

2018-10-04T00:01:45+00:00

[ Upstream commit d3ac5598c5010a8999978ebbcca3b1c6188ca36b ]

Comparing an int to a size, which is unsigned, causes the int to become
unsigned, giving the wrong result.  usb_get_descriptor can return a
negative error code.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// 
@@
int x;
expression e,e1;
identifier f;
@@

*x = f(...);
... when != x = e1
    when != if (x < 0 || ...) { ... return ...; }
*x < sizeof(e)
// 

Signed-off-by: Julia Lawall 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

USB: wusbcore: fix NULL-deref at probe

2017-03-30T07:41:24+00:00

commit 03ace948a4eb89d1cf51c06afdfc41ebca5fdb27 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

This specifically fixes the NULL-pointer dereference when probing HWA HC
devices.

Fixes: df3654236e31 ("wusb: add the Wire Adapter (WA) core")
Cc: Inaky Perez-Gonzalez 
Cc: David Vrabel 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

wusbcore: Fix one more crypto-on-the-stack bug

2017-01-19T19:18:01+00:00

commit 620f1a632ebcc9811c2f8009ba52297c7006f805 upstream.

The driver put a constant buffer of all zeros on the stack and
pointed a scatterlist entry at it.  This doesn't work with virtual
stacks.  Use ZERO_PAGE instead.

Reported-by: Eric Biggers 
Signed-off-by: Andy Lutomirski 
Signed-off-by: Greg Kroah-Hartman

wusb: fix error return code in wusb_prf()

2016-10-19T13:28:29+00:00

Fix to return error code -ENOMEM from the kmalloc() error handling
case instead of 0, as done elsewhere in this function.

Fixes: a19b882c07a6 ("wusb: Stop using the stack for sg crypto scratch space")
Signed-off-by: Wei Yongjun 
Signed-off-by: Greg Kroah-Hartman

wusb: Stop using the stack for sg crypto scratch space

2016-10-17T09:50:43+00:00

Pointing an sg list at the stack is verboten and, with
CONFIG_VMAP_STACK=y, will malfunction.  Use kmalloc for the wusb
crypto stack space instead.

Untested -- I'm not entirely convinced that this hardware exists in
the wild.

Signed-off-by: Andy Lutomirski 
Signed-off-by: Greg Kroah-Hartman

USB: wusbcore: add in missing white space in error message text

2016-09-13T15:24:24+00:00

A dev_err message spans two lines and the literal string is missing
a white space between words. Add the white space and reformat the
message to not span multiple lines.

Signed-off-by: Colin Ian King 
Signed-off-by: Greg Kroah-Hartman

usb: wusbcore: wa-nep: don't print on ENOMEM

2016-08-30T17:17:39+00:00

All kmalloc-based functions print enough information on failures.

Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman

usb: wusbcore: security: don't print on ENOMEM

2016-08-30T17:17:39+00:00

All kmalloc-based functions print enough information on failures.

Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman

usb: wusbcore: crypto: don't print on ENOMEM

2016-08-30T17:17:39+00:00

All kmalloc-based functions print enough information on failures.

Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman

usb: wusbcore: wa-xfer: don't print error when allocating urb fails

2016-08-15T13:54:27+00:00

kmalloc will print enough information in case of failure.

Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman