linux.git/drivers/usb/usbip, branch v4.16

usbip: vudc: fix null pointer dereference on udc->lock

2018-03-09T18:01:07+00:00

Currently the driver attempts to spin lock on udc->lock before a NULL
pointer check is performed on udc, hence there is a potential null
pointer dereference on udc->lock.  Fix this by moving the null check
on udc before the lock occurs.

Fixes: ea6873a45a22 ("usbip: vudc: Add SysFS infrastructure for VUDC")
Signed-off-by: Colin Ian King 
Acked-by: Shuah Khan 
Reviewed-by: Krzysztof Opasiak 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: keep usbip_device sockfd state in sync with tcp_socket

2018-02-15T17:43:57+00:00

Keep usbip_device sockfd state in sync with tcp_socket. When tcp_socket
is reset to null, reset sockfd to -1 to keep it in sync.

Signed-off-by: Shuah Khan 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

USB: move many drivers to use DEVICE_ATTR_WO

2018-01-24T07:49:52+00:00

Instead of "open coding" a DEVICE_ATTR() define, use the
DEVICE_ATTR_WO() macro instead, which does everything properly instead.

This does require a few static functions to be renamed to work properly,
but thanks to a script from Joe Perches, this was easily done.

Reported-by: Joe Perches 
Cc: Peter Chen 
Cc: Valentina Manea 
Acked-by: Felipe Balbi 
Acked-by: Johan Hovold 
Acked-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

usbip: vhci_hcd: update 'status' file header and format

2018-01-22T14:34:37+00:00

Commit 2f2d0088eb93
("usbip: prevent vhci_hcd driver from leaking a socket pointer address")
in the /sys/devices/platform/vhci_hcd/status.

Fix the header and field alignment to reflect the changes and make it
easier to read.

Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

Merge 4.15-rc8 into usb-next

2018-01-15T14:00:11+00:00

We want the USB fixes in here as well for merge issues.

Signed-off-by: Greg Kroah-Hartman

usbip: vudc_tx: fix v_send_ret_submit() vulnerability to null xfer buffer

2018-01-04T16:07:27+00:00

v_send_ret_submit() handles urb with a null transfer_buffer, when it
replays a packet with potential malicious data that could contain a
null buffer.

Add a check for the condition when actual_length > 0 and transfer_buffer
is null.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: remove kernel addresses from usb device and urb debug msgs

2018-01-04T16:07:26+00:00

usbip_dump_usb_device() and usbip_dump_urb() print kernel addresses.
Remove kernel addresses from usb device and urb debug msgs and improve
the message content.

Instead of printing parent device and bus addresses, print parent device
and bus names.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input

2018-01-04T16:07:26+00:00

Harden CMD_SUBMIT path to handle malicious input that could trigger
large memory allocations. Add checks to validate transfer_buffer_length
and number_of_packets to protect against bad input requesting for
unbounded memory allocations.

Signed-off-by: Shuah Khan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usbip: vhci: fix spelling mistake: "synchronuously" -> "synchronously"

2018-01-04T16:05:55+00:00

Trivial fix to spelling mistake in dev_dbg debug message.

Signed-off-by: Colin Ian King 
Signed-off-by: Greg Kroah-Hartman

USB: usbip: remove useless call in usbip_recv

2018-01-04T16:05:55+00:00

Calling msg_data_left(&msg) is only useful for its return value,
which in this particular case is ignored.

Fix this by removing such call.

Addresses-Coverity-ID: 1427080
Fixes: 90120d15f4c3 ("usbip: prevent leaking socket pointer address in messages")
Signed-off-by: Gustavo A. R. Silva 
Acked-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman