linux-stable.git/drivers/usb, branch v3.18.31

USB: uas: Reduce can_queue to MAX_CMNDS

2016-04-18T12:49:36+00:00

[ Upstream commit 55ff8cfbc4e12a7d2187df523938cc671fbebdd1 ]

The uas driver can never queue more then MAX_CMNDS (- 1) tags and tags
are shared between luns, so there is no need to claim that we can_queue
some random large number.

Not claiming that we can_queue 65536 commands, fixes the uas driver
failing to initialize while allocating the tag map with a "Page allocation
failure (order 7)" error on systems which have been running for a while
and thus have fragmented memory.

Cc: stable@vger.kernel.org
Reported-and-tested-by: Yves-Alexis Perez 
Signed-off-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

USB: cdc-acm: more sanity checking

2016-04-18T12:49:35+00:00

[ Upstream commit 8835ba4a39cf53f705417b3b3a94eb067673f2c9 ]

An attack has become available which pretends to be a quirky
device circumventing normal sanity checks and crashes the kernel
by an insufficient number of interfaces. This patch adds a check
to the code path for quirky devices.

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

USB: usb_driver_claim_interface: add sanity checking

2016-04-18T12:49:35+00:00

[ Upstream commit 0b818e3956fc1ad976bee791eadcbb3b5fec5bfd ]

Attacks that trick drivers into passing a NULL pointer
to usb_driver_claim_interface() using forged descriptors are
known. This thwarts them by sanity checking.

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

USB: iowarrior: fix oops with malicious USB descriptors

2016-04-18T12:49:35+00:00

[ Upstream commit 4ec0ef3a82125efc36173062a50624550a900ae0 ]

The iowarrior driver expects at least one valid endpoint.  If given
malicious descriptors that specify 0 for the number of endpoints,
it will crash in the probe function.  Ensure there is at least
one endpoint on the interface before using it.

The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87

Reported-by: Ralf Spenneberg 
Cc: stable 
Signed-off-by: Josh Boyer 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usb: hub: fix a typo in hub_port_init() leading to wrong logic

2016-04-18T12:49:24+00:00

[ Upstream commit 0d5ce778c43bf888328231bcdce05d5c860655aa ]

A typo of j for i led to a logic bug. To rule out future
confusion, the variable names are made meaningful.

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usb: retry reset if a device times out

2016-04-12T13:11:32+00:00

[ Upstream commit 264904ccc33c604d4b3141bbd33808152dfac45b ]

Some devices I got show an inability to operate right after
power on if they are already connected. They are beyond recovery
if the descriptors are requested multiple times. So in case of
a timeout we rather bail early and reset again. But it must be
done only on the first loop lest we get into a reset/time out
spiral that can be overcome with a retry.

This patch is a rework of a patch that fell through the cracks.
http://www.spinics.net/lists/linux-usb/msg103263.html

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

USB: qcserial: add Sierra Wireless EM74xx device ID

2016-03-13T17:53:40+00:00

[ Upstream commit 9b957cf794b46861c6b797b816fb31c8f73859d4 ]

[ Upstream commit 04fdbc825ffc02fb098964b92de802fff44e73fd ]

The MC74xx and EM74xx modules use different IDs by default, according
to the Lenovo EM7455 driver for Windows.

Cc: 
Signed-off-by: Bjørn Mork 
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin

USB: qcserial: add Sierra Wireless MC74xx/EM74xx

2016-03-13T17:53:40+00:00

[ Upstream commit 34a251c6eecaaf5e863ed366089e7ac9a5b78986 ]

commit f504ab1888026d15b5be8f9c262bf4ae9cacd177 upstream.

New device IDs shamelessly lifted from the vendor driver.

Signed-off-by: Bjørn Mork 
Acked-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

USB: serial: option: add support for Quectel UC20

2016-03-11T14:45:25+00:00

[ Upstream commit c0992d0f54847d0d1d85c60fcaa054f175ab1ccd ]

Add support for Quectel UC20 and blacklist the QMI interface.

Signed-off-by: Yegor Yefremov 
Cc: stable 
[johan: amend commit message ]
Signed-off-by: Johan Hovold 

Signed-off-by: Sasha Levin

USB: serial: option: add support for Telit LE922 PID 0x1045

2016-03-11T14:45:25+00:00

[ Upstream commit 5deef5551c77e488922cc4bf4bc76df63be650d0 ]

This patch adds support for 0x1045 PID of Telit LE922.

Signed-off-by: Daniele Palmas 
Cc: stable 
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin