Commit 887c8ba7 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'usb-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 

Pull USB fixes from Greg KH:
 "Here are a number of USB fixes for 4.14-rc4 to resolved reported
  issues.

  There's a bunch of stuff in here based on the great work Andrey
  Konovalov is doing in fuzzing the USB stack. Lots of bug fixes when
  dealing with corrupted USB descriptors that we've never seen in
  "normal" operation, but is now ensuring the stack is much more
  hardened overall.

  There's also the usual XHCI and gadget driver fixes as well, and a
  build error fix, and a few other minor things, full details in the
  shortlog.

  All of these have been in linux-next with no reported issues"

* tag 'usb-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (38 commits)
  usb: dwc3: of-simple: Add compatible for Spreadtrum SC9860 platform
  usb: gadget: udc: atmel: set vbus irqflags explicitly
  usb: gadget: ffs: handle I/O completion in-order
  usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
  usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
  usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
  usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
  usb: gadget: udc: renesas_usb3: fix for no-data control transfer
  USB: dummy-hcd: Fix erroneous synchronization change
  USB: dummy-hcd: fix infinite-loop resubmission bug
  USB: dummy-hcd: fix connection failures (wrong speed)
  USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
  USB: devio: Don't corrupt user memory
  USB: devio: Prevent integer overflow in proc_do_submiturb()
  USB: g_mass_storage: Fix deadlock when driver is unbound
  USB: gadgetfs: Fix crash caused by inadequate synchronization
  USB: gadgetfs: fix copy_to_user while holding spinlock
  USB: uas: fix bug in handling of alternate settings
  usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
  usb-storage: fix bogus hardware error messages for ATA pass-thru devices
  ...
parents 27b3b160 80c82ffe

drivers/usb/class/cdc-wdm.c

+3 −1
Original line number Diff line number Diff line
@@ -190,8 +190,10 @@ static void wdm_in_callback(struct urb *urb) 
	/*

	 * only set a new error if there is no previous error.

	 * Errors are only cleared during read/open

	 * Avoid propagating -EPIPE (stall) to userspace since it is

	 * better handled as an empty read

	 */

	if (desc->rerr  == 0)

	if (desc->rerr == 0 && status != -EPIPE)

		desc->rerr = status;



	if (length + desc->length > desc->wMaxCommand) {

drivers/usb/core/config.c

+12 −4
Original line number Diff line number Diff line
@@ -643,15 +643,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, 


		} else if (header->bDescriptorType ==

				USB_DT_INTERFACE_ASSOCIATION) {

			struct usb_interface_assoc_descriptor *d;



			d = (struct usb_interface_assoc_descriptor *)header;

			if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {

				dev_warn(ddev,

					 "config %d has an invalid interface association descriptor of length %d, skipping\n",

					 cfgno, d->bLength);

				continue;

			}



			if (iad_num == USB_MAXIADS) {

				dev_warn(ddev, "found more Interface "

					       "Association Descriptors "

					       "than allocated for in "

					       "configuration %d\n", cfgno);

			} else {

				config->intf_assoc[iad_num] =

					(struct usb_interface_assoc_descriptor

					*)header;

				config->intf_assoc[iad_num] = d;

				iad_num++;

			}
@@ -852,7 +860,7 @@ int usb_get_configuration(struct usb_device *dev) 
		}



		if (dev->quirks & USB_QUIRK_DELAY_INIT)

			msleep(100);

			msleep(200);



		result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,

		    bigbuffer, length);

drivers/usb/core/devio.c

+10 −1
Original line number Diff line number Diff line
@@ -140,6 +140,9 @@ module_param(usbfs_memory_mb, uint, 0644); 
MODULE_PARM_DESC(usbfs_memory_mb,

		"maximum MB allowed for usbfs buffers (0 = no limit)");



/* Hard limit, necessary to avoid arithmetic overflow */

#define USBFS_XFER_MAX         (UINT_MAX / 2 - 1000000)



static atomic64_t usbfs_memory_usage;	/* Total memory currently allocated */



/* Check whether it's okay to allocate more memory for a transfer */
@@ -1460,6 +1463,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb 
				USBDEVFS_URB_ZERO_PACKET |

				USBDEVFS_URB_NO_INTERRUPT))

		return -EINVAL;

	if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)

		return -EINVAL;

	if (uurb->buffer_length > 0 && !uurb->buffer)

		return -EINVAL;

	if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
@@ -1571,7 +1576,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb 
			totlen += isopkt[u].length;

		}

		u *= sizeof(struct usb_iso_packet_descriptor);

		if (totlen <= uurb->buffer_length)

			uurb->buffer_length = totlen;

		else

			WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d",

				  totlen, uurb->buffer_length);

		break;



	default:

drivers/usb/core/hub.c

+1 −1
Original line number Diff line number Diff line
@@ -4838,7 +4838,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, 
			goto loop;



		if (udev->quirks & USB_QUIRK_DELAY_INIT)

			msleep(1000);

			msleep(2000);



		/* consecutive bus-powered hubs aren't reliable; they can

		 * violate the voltage drop budget.  if the new child has

drivers/usb/core/message.c

+4 −0
Original line number Diff line number Diff line
@@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, 
			elength = 1;

			goto next_desc;

		}

		if ((buflen < elength) || (elength < 3)) {

			dev_err(&intf->dev, "invalid descriptor buffer length\n");

			break;

		}

		if (buffer[1] != USB_DT_CS_INTERFACE) {

			dev_err(&intf->dev, "skipping garbage\n");

			goto next_desc;

CRA Git | Maintained and supported by SUSTech CRA and CCSE