Commit e3ebc3ad authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge tag 'usb-serial-4.18-rc4' of... 

Merge tag 'usb-serial-4.18-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial

 into usb-linus

USB-serial fixes for v4.18-rc4

Here are three fixes for broken control-transfer error handling, which
could lead to uninitialised slab data leaking to user space.

Included is also a new device id for cp210x.

All but the final two patches have been in linux-next with no reported
issues.

Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
parents b3a65328 794744ab

drivers/usb/serial/ch341.c

+1 −1
Original line number Diff line number Diff line
@@ -128,7 +128,7 @@ static int ch341_control_in(struct usb_device *dev, 
	r = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), request,

			    USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,

			    value, index, buf, bufsize, DEFAULT_TIMEOUT);

	if (r < bufsize) {

	if (r < (int)bufsize) {

		if (r >= 0) {

			dev_err(&dev->dev,

				"short control message received (%d < %u)\n",

drivers/usb/serial/cp210x.c

+1 −0
Original line number Diff line number Diff line
@@ -149,6 +149,7 @@ static const struct usb_device_id id_table[] = { 
	{ USB_DEVICE(0x10C4, 0x8977) },	/* CEL MeshWorks DevKit Device */

	{ USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */

	{ USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */

	{ USB_DEVICE(0x10C4, 0x89FB) }, /* Qivicon ZigBee USB Radio Stick */

	{ USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */

	{ USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */

	{ USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */

drivers/usb/serial/keyspan_pda.c

+3 −1
Original line number Diff line number Diff line
@@ -369,8 +369,10 @@ static int keyspan_pda_get_modem_info(struct usb_serial *serial, 
			     3, /* get pins */

			     USB_TYPE_VENDOR|USB_RECIP_INTERFACE|USB_DIR_IN,

			     0, 0, data, 1, 2000);

	if (rc >= 0)

	if (rc == 1)

		*value = *data;

	else if (rc >= 0)

		rc = -EIO;



	kfree(data);

	return rc;

drivers/usb/serial/mos7840.c

+3 −0
Original line number Diff line number Diff line
@@ -468,6 +468,9 @@ static void mos7840_control_callback(struct urb *urb) 
	}



	dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);

	if (urb->actual_length < 1)

		goto out;



	dev_dbg(dev, "%s mos7840_port->MsrLsr is %d port %d\n", __func__,

		mos7840_port->MsrLsr, mos7840_port->port_num);

	data = urb->transfer_buffer;

CRA Git | Maintained and supported by SUSTech CRA and CCSE