linux.git/drivers/usb, branch v4.2-rc3

configfs: fix kernel infoleak through user-controlled format string

2015-07-17T23:39:53+00:00

Some modules call config_item_init_type_name() and config_group_init_type_name()
with parameter "name" directly controlled by userspace.  These two
functions call config_item_set_name() with this name used as a format
string, which can be used to leak information such as content of the
stack to userspace.

For example, make_netconsole_target() in netconsole module calls
config_item_init_type_name() with the name of a newly-created directory.
This means that the following commands give some unexpected output, with
configfs mounted in /sys/kernel/config/ and on a system with a
configured eth0 ethernet interface:

    # modprobe netconsole
    # mkdir /sys/kernel/config/netconsole/target_%lx
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # echo 1 > /sys/kernel/config/netconsole/target_%lx/enabled
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # dmesg |tail -n1
    [  142.697668] netconsole: target (target_ffffffffc0ae8080) is
    enabled, disable to update parameters

The directory name is correct but %lx has been interpreted in the
internal item name, displayed here in the error message used by
store_dev_name() in drivers/net/netconsole.c.

To fix this, update every caller of config_item_set_name to use "%s"
when operating on untrusted input.

This issue was found using -Wformat-security gcc flag, once a __printf
attribute has been added to config_item_set_name().

Signed-off-by: Nicolas Iooss 
Acked-by: Greg Kroah-Hartman 
Acked-by: Felipe Balbi 
Acked-by: Joel Becker 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Merge tag 'usb-serial-4.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

2015-07-10T19:35:14+00:00

Johan writes:

USB-serial fixes for v4.2-rc2

Here's an idr memory-leak fix and a couple of new device ids.

Included is also a build fix for mos7720 on the mn10300 architecture,
which has a register with the same name as one of the driver defines.

Signed-off-by: Johan Hovold

USB: serial: Destroy serial_minors IDR on module exit

2015-07-09T08:41:23+00:00

Destroy serial_minors IDR on module exit, reclaiming the allocated memory.

This was detected by the following semantic patch (written by Luis
Rodriguez )


@ defines_module_init @
declarer name module_init, module_exit;
declarer name DEFINE_IDR;
identifier init;
@@

module_init(init);

@ defines_module_exit @
identifier exit;
@@

module_exit(exit);

@ declares_idr depends on defines_module_init && defines_module_exit @
identifier idr;
@@

DEFINE_IDR(idr);

@ on_exit_calls_destroy depends on declares_idr && defines_module_exit @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 idr_destroy(&idr);
 ...
}

@ missing_module_idr_destroy depends on declares_idr && defines_module_exit && !on_exit_calls_destroy @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 +idr_destroy(&idr);
}


Signed-off-by: Johannes Thumshirn 
Cc: stable 	# v3.11
Signed-off-by: Johan Hovold

usb: gadget: f_midi: fix error recovery path

2015-07-06T17:34:08+00:00

In case kstrdup() fails the resources to release are
midi->in_port[] and midi. No cards have been registered,
so no need to unregister any.

Signed-off-by: Andrzej Pietrasiewicz 
Signed-off-by: Felipe Balbi

usb: phy: mxs: suspend to RAM causes NULL pointer dereference

2015-07-06T17:34:08+00:00

Triggering suspend to RAM via sysfs on a i.MX28 causes a NULL pointer
dereference. This patch avoids the oops in mxs_phy_get_vbus_status()
by aborting since there is no syscon available.

Signed-off-by: Stefan Wahren 
Fixes: efdbd3a5d6e ("usb: phy: mxs: do not set PWD.RXPWD1PT1 for low speed connection")
CC:  # 4.0
Acked-by: Peter Chen 
Signed-off-by: Felipe Balbi

usb: gadget: udc: fix free_irq() after request_irq() failed

2015-07-06T17:34:08+00:00

My static checker detected the mistake. I fix this by changing "goto
err_irq" to "goto err_req". The label err_irq is not used now
so this patch also removes it.

Signed-off-by: Takeshi Yoshimura 
Signed-off-by: Felipe Balbi

usb: gadget: composite: Fix NULL pointer dereference

2015-07-06T17:34:08+00:00

commit f563d230903210acc ("usb: gadget: composite: add req_match method
to usb_function") accesses cdev->config even before set config
is invoked causing a NULL pointer dereferencing error while running
Lecroy Mass Storage Compliance test.

Fix it here by accessing cdev->config only if it is non NULL.

Fixes: commit f563d230903210acc ("usb: gadget: composite: add req_match
method to usb_function").

Signed-off-by: Kishon Vijay Abraham I 
Signed-off-by: Felipe Balbi

usb: gadget: f_fs: do not set cancel function on synchronous {read,write}

2015-07-06T17:34:08+00:00

do not try to set cancel function in synchronous operations in
ffs_epfile_{read,write}_iter.

Cc:  # v4.0+
Acked-by: Al Viro 
Signed-off-by: Rui Miguel Silva 
Signed-off-by: Felipe Balbi

usb: f_mass_storage: limit number of reported LUNs

2015-07-06T17:34:08+00:00

Mass storage function created via configfs always reports eight LUNs
to the hosts even if only one LUN has been configured.  Adjust the
number when the USB function is allocated based on LUNs that user
has created.

Cc: 
Tested-by: Gregory CLEMENT 
Signed-off-by: Michal Nazarewicz 
Signed-off-by: Felipe Balbi

usb: dwc3: core: avoid NULL pointer dereference

2015-07-06T17:34:08+00:00

commit 3e10a2ce98d1 ("usb: dwc3: add hsphy_interface
property") introduced a possible NULL pointer
dereference because dwc->hsphy_interface can be
NULL.

In order to fix it, all we have to do is guard
strncmp() against a NULL argument.

Fixes: 3e10a2ce98d1 ("usb: dwc3: add hsphy_interface property")
Tested-by: Murali Karicheri 
Signed-off-by: Felipe Balbi