linux-stable.git/drivers/usb, branch v4.1.26 Linux kernel stable tree USB: serial: quatech2: fix use-after-free in probe error path 2016-06-06T23:12:15+00:00 Johan Hovold johan@kernel.org 2016-05-08T18:08:02+00:00 7124f5dfff7b22fd91546ce7dbf9e80b56f0d61f [ Upstream commit 028c49f5e02a257c94129cd815f7c8485f51d4ef ] The interface read URB is submitted in attach, but was only unlinked by the driver at disconnect. In case of a late probe error (e.g. due to failed minor allocation), disconnect is never called and we would end up with active URBs for an unbound interface. This in turn could lead to deallocated memory being dereferenced in the completion callback. Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver") Cc: stable <stable@vger.kernel.org> # v3.5: 40d04738491d Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit 028c49f5e02a257c94129cd815f7c8485f51d4ef ]

The interface read URB is submitted in attach, but was only unlinked by
the driver at disconnect.

In case of a late probe error (e.g. due to failed minor allocation),
disconnect is never called and we would end up with active URBs for an
unbound interface. This in turn could lead to deallocated memory being
dereferenced in the completion callback.

Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver")
Cc: stable <stable@vger.kernel.org>	# v3.5: 40d04738491d
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
USB: serial: mxuport: fix use-after-free in probe error path 2016-06-06T23:12:15+00:00 Johan Hovold johan@kernel.org 2016-05-08T18:08:01+00:00 17e958ca3f508c361325688ab1da7144febb35fe [ Upstream commit 9e45284984096314994777f27e1446dfbfd2f0d7 ] The interface read and event URBs are submitted in attach, but were never explicitly unlinked by the driver. Instead the URBs would have been killed by usb-serial core on disconnect. In case of a late probe error (e.g. due to failed minor allocation), disconnect is never called and we could end up with active URBs for an unbound interface. This in turn could lead to deallocated memory being dereferenced in the completion callbacks. Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver") Cc: stable <stable@vger.kernel.org> # v3.14 Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit 9e45284984096314994777f27e1446dfbfd2f0d7 ]

The interface read and event URBs are submitted in attach, but were
never explicitly unlinked by the driver. Instead the URBs would have
been killed by usb-serial core on disconnect.

In case of a late probe error (e.g. due to failed minor allocation),
disconnect is never called and we could end up with active URBs for an
unbound interface. This in turn could lead to deallocated memory being
dereferenced in the completion callbacks.

Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX
driver")
Cc: stable <stable@vger.kernel.org>	# v3.14
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
USB: serial: keyspan: fix use-after-free in probe error path 2016-06-06T23:12:15+00:00 Johan Hovold johan@kernel.org 2016-05-08T18:07:58+00:00 d2e9eeb2504c73c09c415e5d4fc4cc33ffc4cb9f [ Upstream commit 35be1a71d70775e7bd7e45fa6d2897342ff4c9d2 ] The interface instat and indat URBs were submitted in attach, but never unlinked in release before deallocating the corresponding transfer buffers. In the case of a late probe error (e.g. due to failed minor allocation), disconnect would not have been called before release, causing the buffers to be freed while the URBs are still in use. We'd also end up with active URBs for an unbound interface. Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect, release") Cc: stable <stable@vger.kernel.org> # v2.6.31 Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit 35be1a71d70775e7bd7e45fa6d2897342ff4c9d2 ]

The interface instat and indat URBs were submitted in attach, but never
unlinked in release before deallocating the corresponding transfer
buffers.

In the case of a late probe error (e.g. due to failed minor allocation),
disconnect would not have been called before release, causing the
buffers to be freed while the URBs are still in use. We'd also end up
with active URBs for an unbound interface.

Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect,
release")
Cc: stable <stable@vger.kernel.org>	# v2.6.31
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
USB: serial: io_edgeport: fix memory leaks in probe error path 2016-06-06T23:12:14+00:00 Johan Hovold johan@kernel.org 2016-05-08T18:07:57+00:00 90eb29f547e7de02d663257a3e8b042b80940925 [ Upstream commit c8d62957d450cc1a22ce3242908709fe367ddc8e ] URBs and buffers allocated in attach for Epic devices would never be deallocated in case of a later probe error (e.g. failure to allocate minor numbers) as disconnect is then never called. Fix by moving deallocation to release and making sure that the URBs are first unlinked. Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect, release") Cc: stable <stable@vger.kernel.org> # v2.6.31 Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit c8d62957d450cc1a22ce3242908709fe367ddc8e ]

URBs and buffers allocated in attach for Epic devices would never be
deallocated in case of a later probe error (e.g. failure to allocate
minor numbers) as disconnect is then never called.

Fix by moving deallocation to release and making sure that the
URBs are first unlinked.

Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect,
release")
Cc: stable <stable@vger.kernel.org>	# v2.6.31
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
USB: serial: io_edgeport: fix memory leaks in attach error path 2016-06-06T23:12:14+00:00 Johan Hovold johan@kernel.org 2016-05-08T18:07:56+00:00 7bbc1379766b1887cd7b3c225c78acca5b82ec5e [ Upstream commit c5c0c55598cefc826d6cfb0a417eeaee3631715c ] Private data, URBs and buffers allocated for Epic devices during attach were never released on errors (e.g. missing endpoints). Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver") Cc: stable <stable@vger.kernel.org> # v2.6.21 Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit c5c0c55598cefc826d6cfb0a417eeaee3631715c ]

Private data, URBs and buffers allocated for Epic devices during
attach were never released on errors (e.g. missing endpoints).

Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver")
Cc: stable <stable@vger.kernel.org>	# v2.6.21
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
USB: serial: cp210x: fix hardware flow-control disable 2016-06-03T23:15:47+00:00 Konstantin Shkolnyy konstantin.shkolnyy@gmail.com 2016-05-04T21:56:52+00:00 e4e5983477fd480a044bbaef62a4c53529879b2e [ Upstream commit a377f9e906af4df9071ba8ddba60188cb4013d93 ] A bug in the CRTSCTS handling caused RTS to alternate between CRTSCTS=0 => "RTS is transmit active signal" and CRTSCTS=1 => "RTS is used for receive flow control" instead of CRTSCTS=0 => "RTS is statically active" and CRTSCTS=1 => "RTS is used for receive flow control" This only happened after first having enabled CRTSCTS. Signed-off-by: Konstantin Shkolnyy <konstantin.shkolnyy@gmail.com> Fixes: 39a66b8d22a3 ("[PATCH] USB: CP2101 Add support for flow control") Cc: stable <stable@vger.kernel.org> [johan: reword commit message ] Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit a377f9e906af4df9071ba8ddba60188cb4013d93 ]

A bug in the CRTSCTS handling caused RTS to alternate between

CRTSCTS=0 => "RTS is transmit active signal" and
CRTSCTS=1 => "RTS is used for receive flow control"

instead of

CRTSCTS=0 => "RTS is statically active" and
CRTSCTS=1 => "RTS is used for receive flow control"

This only happened after first having enabled CRTSCTS.

Signed-off-by: Konstantin Shkolnyy <konstantin.shkolnyy@gmail.com>
Fixes: 39a66b8d22a3 ("[PATCH] USB: CP2101 Add support for flow control")
Cc: stable <stable@vger.kernel.org>
[johan: reword commit message ]
Signed-off-by: Johan Hovold <johan@kernel.org>

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
USB: cp210x: relocate private data from USB interface to port 2016-06-03T23:15:46+00:00 Konstantin Shkolnyy konstantin.shkolnyy@gmail.com 2015-10-28T21:02:34+00:00 f26c00e60f4ddac7cf972f2752d50094b0d60ff7 [ Upstream commit e2ae67a3b55188b0342522d8139acf013feb2a69 ] This change is preparation for implementing a cp2108 bug workaround. The workaround requires storing some private data. Right now the data is attached to the USB interface and allocated in the attach() callback. The bug detection requires USB I/O which is done easier from port_probe() callback rather than attach(). Since the USB access functions take port as a parameter, and since the private data is used exclusively by these functions, it can be allocated in port_probe(). Also, all cp210x devices have exactly 1 port per USB iterface, so moving private data from the USB interface to port is trivial. Signed-off-by: Konstantin Shkolnyy <konstantin.shkolnyy@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit e2ae67a3b55188b0342522d8139acf013feb2a69 ]

This change is preparation for implementing a cp2108 bug workaround.
The workaround requires storing some private data. Right now the data is
attached to the USB interface and allocated in the attach() callback.
The bug detection requires USB I/O which is done easier from port_probe()
callback rather than attach(). Since the USB access functions take port
as a parameter, and since the private data is used exclusively by these
functions, it can be allocated in port_probe(). Also, all cp210x devices
have exactly 1 port per USB iterface, so moving private data from the USB
interface to port is trivial.

Signed-off-by: Konstantin Shkolnyy <konstantin.shkolnyy@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
USB: serial: option: add even more ZTE device ids 2016-06-03T23:15:45+00:00 Lei Liu lei35151@163.com 2016-05-04T08:34:22+00:00 4d5aaca6145b49ef9fe82dfa6db61a90e83ba912 [ Upstream commit 74d2a91aec97ab832790c9398d320413ad185321 ] Add even more ZTE device ids. Signed-off-by: lei liu <liu.lei78@zte.com.cn> Cc: stable <stable@vger.kernel.org> [johan: rebase and replace commit message ] Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit 74d2a91aec97ab832790c9398d320413ad185321 ]

Add even more ZTE device ids.

Signed-off-by: lei liu <liu.lei78@zte.com.cn>
Cc: stable <stable@vger.kernel.org>
[johan: rebase and replace commit message ]
Signed-off-by: Johan Hovold <johan@kernel.org>

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
USB: serial: option: add more ZTE device ids 2016-06-03T23:15:45+00:00 lei liu liu.lei78@zte.com.cn 2016-05-03T21:44:19+00:00 feb498621fc35eb2d8e4929a466abf38c7c60543 [ Upstream commit f0d09463c59c2d764a6c6d492cbe6d2c77f27153 ] More ZTE device ids. Signed-off-by: lei liu <liu.lei78@zte.com.cn> Cc: stable <stable@vger.kernel.org> [properly sort them - gregkh] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit f0d09463c59c2d764a6c6d492cbe6d2c77f27153 ]

More ZTE device ids.

Signed-off-by: lei liu <liu.lei78@zte.com.cn>
Cc: stable <stable@vger.kernel.org>
[properly sort them - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
usb: misc: usbtest: fix pattern tests for scatterlists. 2016-06-03T23:15:44+00:00 Mathias Nyman mathias.nyman@linux.intel.com 2016-05-02T08:39:03+00:00 27094468938ac9cc4a0b87ed7d5899bd8717e73b [ Upstream commit cdc77c82a8286b1181b81b6e5ef60c8e83ded7bc ] The current implemenentation restart the sent pattern for each entry in the sg list. The receiving end expects a continuous pattern, and test will fail unless scatterilst entries happen to be aligned with the pattern Fix this by calculating the pattern byte based on total sent size instead of just the current sg entry. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Fixes: 8b5249019352 ("[PATCH] USB: usbtest: scatterlist OUT data pattern testing") Cc: <stable@vger.kernel.org> # v2.6.18+ Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit cdc77c82a8286b1181b81b6e5ef60c8e83ded7bc ]

The current implemenentation restart the sent pattern for each entry in
the sg list. The receiving end expects a continuous pattern, and test
will fail unless scatterilst entries happen to be aligned with the
pattern

Fix this by calculating the pattern byte based on total sent size
instead of just the current sg entry.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Fixes: 8b5249019352 ("[PATCH] USB: usbtest: scatterlist OUT data pattern testing")
Cc: <stable@vger.kernel.org> # v2.6.18+
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>