aboutsummaryrefslogtreecommitdiff
path: root/drivers/usb/misc/yurex.c
AgeCommit message (Collapse)AuthorFilesLines
2019-04-25USB: yurex: Fix protection fault after device removalAlan Stern1-0/+1
The syzkaller USB fuzzer found a general-protection-fault bug in the yurex driver. The fault occurs when a device has been unplugged; the driver's interrupt-URB handler logs an error message referring to the device by name, after the device has been unregistered and its name deallocated. This problem is caused by the fact that the interrupt URB isn't cancelled until the driver's private data structure is released, which can happen long after the device is gone. The cure is to make sure that the interrupt URB is killed before yurex_disconnect() returns; this is exactly the sort of thing that usb_poison_urb() was meant for. Signed-off-by: Alan Stern <[email protected]> Reported-and-tested-by: [email protected] CC: <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2018-09-05USB: yurex: Check for truncation in yurex_read()Ben Hutchings1-0/+3
snprintf() always returns the full length of the string it could have printed, even if it was truncated because the buffer was too small. So in case the counter value is truncated, we will over-read from in_buffer and over-write to the caller's buffer. I don't think it's actually possible for this to happen, but in case truncation occurs, WARN and return -EIO. Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2018-09-05USB: yurex: Fix buffer over-read in yurex_write()Ben Hutchings1-2/+3
If the written data starts with a digit, yurex_write() tries to parse it as an integer using simple_strtoull(). This requires a null- terminator, and currently there's no guarantee that there is one. (The sample program at https://github.com/NeoCat/YUREX-driver-for-Linux/blob/master/sample/yurex_clock.pl writes an integer without a null terminator. It seems like it must have worked by chance!) Always add a null byte after the written data. Enlarge the buffer to allow for this. Cc: [email protected] Signed-off-by: Ben Hutchings <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2018-07-06USB: yurex: fix out-of-bounds uaccess in read handlerJann Horn1-17/+6
In general, accessing userspace memory beyond the length of the supplied buffer in VFS read/write handlers can lead to both kernel memory corruption (via kernel_read()/kernel_write(), which can e.g. be triggered via sys_splice()) and privilege escalation inside userspace. Fix it by using simple_read_from_buffer() instead of custom logic. Fixes: 6bc235a2e24a ("USB: add driver for Meywa-Denki & Kayac YUREX") Signed-off-by: Jann Horn <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-11-04USB: misc: Remove redundant license textGreg Kroah-Hartman1-5/+0
Now that the SPDX tag is in all USB files, that identifies the license in a specific and legally-defined manner. So the extra GPL text wording can be removed as it is no longer needed at all. This is done on a quest to remove the 700+ different ways that files in the kernel describe the GPL license text. And there's unneeded stuff like the address (sometimes incorrect) for the FSF which is never needed. No copyright headers or other non-license-description text was removed. Cc: Keith Packard <[email protected]> Cc: Juergen Stuber <[email protected]> Cc: Cesar Miquel <[email protected]> Cc: Richard Leitner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-11-04USB: add SPDX identifiers to all remaining files in drivers/usb/Greg Kroah-Hartman1-0/+1
It's good to have SPDX identifiers in all files to make it easier to audit the kernel tree for correct licenses. Update the drivers/usb/ and include/linux/usb* files with the correct SPDX license identifier based on the license text in the file itself. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This work is based on a script and data from Thomas Gleixner, Philippe Ombredanne, and Kate Stewart. Cc: Thomas Gleixner <[email protected]> Cc: Kate Stewart <[email protected]> Cc: Philippe Ombredanne <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> Acked-by: Felipe Balbi <[email protected]> Acked-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-03-23USB: yurex: refactor endpoint retrievalJohan Hovold1-11/+5
Use the new endpoint helpers to lookup the required interrupt-in endpoint. Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: yurex: don't print on ENOMEMWolfram Sang1-6/+2
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: yurex: don't print error when allocating urb failsWolfram Sang1-6/+2
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-11-03usb: yurex: fixed sparse warning of incorrect typeSudip Mukherjee1-2/+4
fixed sparse warning of 1) incorrect type (different address spaces) 2) incorrect type in initializer Signed-off-by: Sudip Mukherjee <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-09-23usb: misc: yurex: remove useless casting of private_dataArjun Sreedharan1-4/+4
Signed-off-by: Arjun Sreedharan <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-05-27USB: yurex: fix race between probe() and read()Oliver Neukum1-2/+1
There's a window during which read() would return 0 instead of a correct error for no data yet. Reorder initialization to fix the race. Signed-off-by: Oliver Neukum <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-01-08usb: delete non-required instances of include <linux/init.h>Paul Gortmaker1-1/+0
None of these files are actually using any __init type directives and hence don't need to include <linux/init.h>. Most are just a left over from __devinit and __cpuinit removal, or simply due to code getting copied from one driver to the next. Signed-off-by: Paul Gortmaker <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-01-03USB: yurex: fix spelling mistake in commentRahul Bedarkar1-1/+1
fix spelling mistake in comment Signed-off-by: Rahul Bedarkar <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-04-29yurex: don't wank with fasync on ->release()...Al Viro1-2/+0
Signed-off-by: Al Viro <[email protected]>
2012-05-01USB: yurex.c: remove dbg() usageGreg Kroah-Hartman1-5/+9
dbg() was a very old USB-specific macro that should no longer be used. This patch removes it from being used in the driver and uses dev_dbg() instead. CC: Tomoki Sekiyama <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2012-04-22Merge 3.4-rc4 into usb-next.Greg Kroah-Hartman1-17/+23
This resolves the conflict in: drivers/usb/host/ehci-fsl.c And picks up loads of xhci bugfixes to make it easier for others to test with. Signed-off-by: Greg Kroah-Hartman <[email protected]>
2012-04-20USB: yurex.c: remove err() usageGreg Kroah-Hartman1-17/+23
err() was a very old USB-specific macro that I thought had gone away. This patch removes it from being used in the driver and uses dev_err() instead. Signed-off-by: Greg Kroah-Hartman <[email protected]>
2012-04-18USB: yurex: Fix missing URB_NO_TRANSFER_DMA_MAP flag in urbTomoki Sekiyama1-1/+1
Current probing code is setting URB_NO_TRANSFER_DMA_MAP flag into a wrong urb structure, and this causes BUG_ON with some USB host implementations. This patch fixes the issue. Signed-off-by: Tomoki Sekiyama <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2012-04-18USB: yurex: Remove allocation of coherent buffer for setup-packet bufferTomoki Sekiyama1-6/+2
Removes allocation of coherent buffer for the control-request setup-packet buffer from the yurex driver. Using coherent buffers for setup-packet is obsolete and does not work with some USB host implementations. Signed-off-by: Tomoki Sekiyama <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2011-11-18USB: convert drivers/usb/* to use module_usb_driver()Greg Kroah-Hartman1-21/+1
This converts the drivers in drivers/usb/* to use the module_usb_driver() macro which makes the code smaller and a bit simpler. Added bonus is that it removes some unneeded kernel log messages about drivers loading and/or unloading. Cc: Simon Arlott <[email protected]> Cc: Duncan Sands <[email protected]> Cc: Matthieu CASTET <[email protected]> Cc: Stanislaw Gruszka <[email protected]> Cc: Pete Zaitcev <[email protected]> Cc: Oliver Neukum <[email protected]> Cc: Juergen Stuber <[email protected]> Cc: Cesar Miquel <[email protected]> Cc: Matthew Dharm <[email protected]> Cc: Matthew Wilcox <[email protected]> Cc: Sarah Sharp <[email protected]> Cc: Kuninori Morimoto <[email protected]> Cc: Felipe Balbi <[email protected]> Cc: Lucas De Marchi <[email protected]> Cc: Michael Hund <[email protected]> Cc: Zack Parsons <[email protected]> Cc: Melchior FRANZ <[email protected]> Cc: Tomoki Sekiyama <[email protected]> Cc: Dan Carpenter <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-11-30USB: yurex: add .llseek fop to file_operationsTomoki Sekiyama1-0/+1
Default llseek operation behavior was changed by the patch named "vfs: make no_llseek the default" after the yurex driver had been merged, so the llseek to yurex is now ignored. This patch add llseek fop with default_llseek to yurex driver to catch up to the change. Signed-off-by: Tomoki Sekiyama <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-10-22USB: yurex: fix memory leak and corrupted messagesTomoki Sekiyama1-6/+17
This fixes the memory leak on disconnecting the device. In addition, it fixes some messages corrupted by incorrect encoding. Signed-off-by: Tomoki Sekiyama <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-10-22USB: yurex: assign a real minor number to the driverGreg Kroah-Hartman1-2/+2
This assigns the minor number 192 to the yurex driver. We also fix up the previous usb minor number entry, it was wrong. Cc: Tomoki Sekiyama <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2010-10-22USB: add driver for Meywa-Denki & Kayac YUREXTomoki Sekiyama1-0/+552
Meywa-Denki/Kayac YUREX is a leg-shakes sensor device. See http://bbu.kayac.com/en/about/ for further information. This driver support read/write the leg-shakes counter in the device via a device file /dev/yurex[0-9]*. [minor coding style cleanups fixed by gregkh] Signed-off-by: Tomoki Sekiyama <[email protected]> Cc: Jiri Kosina <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.