aboutsummaryrefslogtreecommitdiff
path: root/drivers/usb/misc
AgeCommit message (Collapse)AuthorFilesLines
2017-03-14USB: uss720: fix NULL-deref at probeJohan Hovold1-0/+5
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints. Note that the endpoint access that causes the NULL-deref is currently only used for debugging purposes during probe so the oops only happens when dynamic debugging is enabled. This means the driver could be rewritten to continue to accept device with only two endpoints, should such devices exist. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <[email protected]> Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-03-14USB: lvtest: fix NULL-deref at probeJohan Hovold1-0/+4
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should the probed device lack endpoints. Note that this driver does not bind to any devices by default. Fixes: ce21bfe603b3 ("USB: Add LVS Test device driver") Cc: stable <[email protected]> # 3.17 Cc: Pratyush Anand <[email protected]> Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-03-14USB: idmouse: fix NULL-deref at probeJohan Hovold1-0/+3
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <[email protected]> Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-03-09usb: usb251xb: dt: add unit suffix to oc-delay and power-on-timeRichard Leitner1-15/+20
Rename oc-delay-* to oc-delay-us and make it expect a time value. Furthermore add -ms suffix to power-on-time. There changes were suggested by Rob Herring in https://lkml.org/lkml/2017/2/15/1283. Signed-off-by: Richard Leitner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-03-09usb: usb251xb: remove max_{power,current}_{sp,bp} propertiesRichard Leitner1-20/+4
Remove the max_{power,current}_{sp,bp} properties of the usb251xb driver from devicetree. This is done to simplify the dt bindings as requested by Rob Herring in https://lkml.org/lkml/2017/2/15/1283. If those properties are ever needed by somebody they can be enabled again easily. Signed-off-by: Richard Leitner <[email protected]> Acked-by: Rob Herring <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-03-09USB: iowarrior: fix NULL-deref in writeJohan Hovold1-0/+8
Make sure to verify that we have the required interrupt-out endpoint for IOWarrior56 devices to avoid dereferencing a NULL-pointer in write should a malicious device lack such an endpoint. Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable <[email protected]> # 2.6.21 Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-03-09USB: iowarrior: fix NULL-deref at probeJohan Hovold1-6/+7
Make sure to check for the required interrupt-in endpoint to avoid dereferencing a NULL-pointer should a malicious device lack such an endpoint. Note that a fairly recent change purported to fix this issue, but added an insufficient test on the number of endpoints only, a test which can now be removed. Fixes: 4ec0ef3a8212 ("USB: iowarrior: fix oops with malicious USB descriptors") Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable <[email protected]> # 2.6.21 Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-03-02sched/headers: Prepare to move signal wakeup & sigpending methods from ↵Ingo Molnar4-1/+4
<linux/sched.h> into <linux/sched/signal.h> Fix up affected files that include this signal functionality via sched.h. Acked-by: Linus Torvalds <[email protected]> Cc: Mike Galbraith <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: [email protected] Signed-off-by: Ingo Molnar <[email protected]>
2017-02-27lib/vsprintf.c: remove %Z supportAlexey Dobriyan3-8/+8
Now that %z is standartised in C99 there is no reason to support %Z. Unlike %L it doesn't even make format strings smaller. Use BUILD_BUG_ON in a couple ATM drivers. In case anyone didn't notice lib/vsprintf.o is about half of SLUB which is in my opinion is quite an achievement. Hopefully this patch inspires someone else to trim vsprintf.c more. Link: http://lkml.kernel.org/r/20170103230126.GA30170@avx2 Signed-off-by: Alexey Dobriyan <[email protected]> Cc: Andy Shevchenko <[email protected]> Cc: Rasmus Villemoes <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2017-02-14usb: misc: add USB251xB/xBi Hi-Speed Hub Controller DriverRichard Leitner3-0/+615
This patch adds a driver for configuration of the Microchip USB251xB/xBi USB 2.0 hub controller series with USB 2.0 upstream connectivity, SMBus configuration interface and two to four USB 2.0 downstream ports. Furthermore add myself as a maintainer for this driver. The datasheet can be found at the manufacturers website, see [1]. All device-tree exposed configuration features have been tested on a i.MX6 platform with a USB2512B hub. [1] http://ww1.microchip.com/downloads/en/DeviceDoc/00001692C.pdf Signed-off-by: Richard Leitner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-02-14usb: misc: usbtest: remove redundant check on retval < 0Colin Ian King1-1/+1
The check for retval being less than zero is always true since retval equal to -EPIPE at that point. Replace the existing conditional with just return retval. Detected with CoverityScan, CID#114349 ("Logically dead code") Signed-off-by: Colin Ian King <[email protected]> Reviewed-by: Peter Chen <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-02-08drivers: usb-misc: sisusbvga: remove dead codeGustavo A. R. Silva1-6/+0
The condition modex % 16 cannot be true when modex value is equal to 640 The condition du & 0xff cannot be true when du value is equal to 0x1400 Addresses-Coverity-Id: 101163 Addresses-Coverity-Id: 744373 Signed-off-by: Gustavo A. R. Silva <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2017-02-03usb: misc: adutux: remove redundant error check on copy_to_user return codeColin Ian King1-4/+0
The 2nd check for a non-zero return from copy_to_user is redundant as it is has already been made a few lines earlier. This check was made redundant because of previous fix to the copy_to_user error return check. Detected by CoverityScan, CID#114347 ("Logically Dead Code") Fixes: 1865a9c382ede ("USB: adutux: fix misuse of return value of copy_to_user()") Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-12-24Replace <asm/uaccess.h> with <linux/uaccess.h> globallyLinus Torvalds4-4/+4
This was entirely automated, using the script by Al: PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*<asm/uaccess.h>' sed -i -e "s!$PATT!#include <linux/uaccess.h>!" \ $(git grep -l "$PATT"|grep -v ^include/linux/uaccess.h) to do the replacement at the end of the merge window. Requested-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-12-13Merge tag 'tty-4.10-rc1' of ↵Linus Torvalds1-43/+12
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here's the tty/serial patchset for 4.10-rc1. It's been a quiet kernel cycle for this subsystem, just a small number of changes. A few new serial drivers, and some cleanups to the old vgacon logic, and other minor serial driver changes as well. All of these have been in linux-next for a while with no reported issues" * tag 'tty-4.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (54 commits) serial: 8250_mid fix calltrace when hotplug 8250 serial controller console: Move userspace I/O out of console_lock to fix lockdep warning tty: nozomi: avoid sprintf buffer overflow serial: 8250_pci: Detach low-level driver during PCI error recovery serial: core: don't check port twice in a row mxs-auart: count FIFO overrun errors serial: 8250_dw: Add support for IrDA SIR mode serial: 8250: Expose set_ldisc function serial: 8250: Add IrDA to UART capabilities serial: 8250_dma: power off device after TX is done serial: 8250_port: export serial8250_rpm_{get|put}_tx() serial: sunsu: Free memory when probe fails serial: sunhv: Free memory when remove() is called vt: fix Scroll Lock LED trigger name tty: typo in comments in drivers/tty/vt/keyboard.c tty: amba-pl011: Add earlycon support for SBSA UART tty: nozomi: use permission-specific DEVICE_ATTR variants tty: serial: Make the STM32 serial port depend on it's arch serial: ifx6x60: Free memory when probe fails serial: ioc4_serial: Free memory when kzalloc fails during probe ...
2016-12-08usb: misc: rio500: fix result type for error messageKim Jae Joong1-1/+1
Fix variable type for dev_err about usb_bulk_msg() Signed-off-by: Kim Jae Joong <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-11-18Merge tag 'usb-for-v4.10' of ↵Greg Kroah-Hartman1-3/+3
git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next Felipe writes: usb: patches for v4.10 merge window One big merge this time with a total of 166 non-merge commits. Most of the work, by far, is on dwc2 this time (68.2%) with dwc3 a far second (22.5%). The remaining 9.3% are scattered on gadget drivers. The most important changes for dwc2 are the peripheral side DMA support implemented by Synopsys folks and support for the new IOT dwc2 compatible core from Synopsys. In dwc3 land we have support for high-bandwidth, high-speed isochronous endpoints and some non-critical fixes for large scatter lists. Apart from these, we have our usual set of cleanups, non-critical fixes, etc.
2016-11-03usb: misc: usbtest: remove unnecessary & operationFelipe Balbi1-1/+1
Now that usb_endpoint_maxp() only returns the lowest 11 bits from wMaxPacketSize, we can remove the & operation from this driver. Signed-off-by: Felipe Balbi <[email protected]>
2016-11-03usb: misc: usbtest: make use of new usb_endpoint_maxp_mult()Felipe Balbi1-2/+2
We have introduced a helper to calculate multiplier value from wMaxPacketSize. Start using it. Signed-off-by: Felipe Balbi <[email protected]>
2016-10-27tty: vgacon+sisusb, move scrolldelta to a common helperJiri Slaby1-35/+2
The code is mirrorred in scrolldelta implementations of both vgacon and sisusb. Let's move the code to a separate helper where we will perform a common cleanup and further changes. While we are moving the code, make it linear and save one indentation level. This is done by returning from the "!lines" then-branch immediatelly. This allows flushing the else-branch 1 level to the left, obviously. Few more new lines and comments were added too. And do not forget to export the helper function given sisusb can be built as module. Signed-off-by: Jiri Slaby <[email protected]> Cc: Thomas Winischhofer <[email protected]> Cc: Tomi Valkeinen <[email protected]> Cc: <[email protected]> Cc: <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-10-27tty: vt, cleanup and document con_scrollJiri Slaby1-8/+10
Scrolling helpers scrup and scrdown both accept 'top' and 'bottom' as unsigned int. Number of lines 'nr' is accepted as int, but all callers pass down unsigned too. So change the type of 'nr' to unsigned too. Now, promote unsigned int from the helpers up to the con_scroll hook which actually accepted all those as signed int. Next, the 'dir' parameter can have only two values and we define constants for that: SM_UP and SM_DOWN. Switch them to enum and do proper type checking on 'dir' too. Finally, document the behaviour of the hook. Signed-off-by: Jiri Slaby <[email protected]> Cc: Thomas Winischhofer <[email protected]> Cc: Tomi Valkeinen <[email protected]> Cc: "James E.J. Bottomley" <[email protected]> Cc: Helge Deller <[email protected]> Cc: <[email protected]> Cc: <[email protected]> Cc: <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-10-24hwrng: chaoskey - drop workaround for old hwrng core limitationJulien Cristau1-13/+1
The hwrng core used to mask 'quality' with 1023; that has been removed in commit 506bf0c0464ace57169aadcf02ae397999c57bdd ("hwrng: core - allow perfect entropy from hardware devices"), so we can now just set quality to 1024. Signed-off-by: Julien Cristau <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-21usb: misc: legousbtower: Fix NULL pointer deferenceGreg Kroah-Hartman1-18/+17
This patch fixes a NULL pointer dereference caused by a race codition in the probe function of the legousbtower driver. It re-structures the probe function to only register the interface after successfully reading the board's firmware ID. The probe function does not deregister the usb interface after an error receiving the devices firmware ID. The device file registered (/dev/usb/legousbtower%d) may be read/written globally before the probe function returns. When tower_delete is called in the probe function (after an r/w has been initiated), core dev structures are deleted while the file operation functions are still running. If the 0 address is mappable on the machine, this vulnerability can be used to create a Local Priviege Escalation exploit via a write-what-where condition by remapping dev->interrupt_out_buffer in tower_write. A forged USB device and local program execution would be required for LPE. The USB device would have to delay the control message in tower_probe and accept the control urb in tower_open whilst guest code initiated a write to the device file as tower_delete is called from the error in tower_probe. This bug has existed since 2003. Patch tested by emulated device. Reported-by: James Patrick-Evans <[email protected]> Tested-by: James Patrick-Evans <[email protected]> Signed-off-by: James Patrick-Evans <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-09-13ezusb: constify local structuresJulia Lawall1-1/+1
For structure types defined in the same file or local header files, find top-level static structure declarations that have the following properties: 1. Never reassigned. 2. Address never taken 3. Not passed to a top-level macro call 4. No pointer or array-typed field passed to a function or stored in a variable. Declare structures having all of these properties as const. Done using Coccinelle. Based on a suggestion by Joe Perches <[email protected]>. Signed-off-by: Julia Lawall <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: yurex: don't print on ENOMEMWolfram Sang1-6/+2
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: uss720: don't print on ENOMEMWolfram Sang1-3/+1
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: usbsevseg: don't print on ENOMEMWolfram Sang1-6/+2
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: usblcd: don't print on ENOMEMWolfram Sang1-7/+2
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: trancevibrator: don't print on ENOMEMWolfram Sang1-2/+1
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: lvstest: don't print on ENOMEMWolfram Sang1-3/+1
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: legousbtower: don't print on ENOMEMWolfram Sang1-12/+4
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: ldusb: don't print on ENOMEMWolfram Sang1-15/+5
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: iowarrior: don't print on ENOMEMWolfram Sang1-14/+6
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: idmouse: don't print on ENOMEMWolfram Sang1-1/+0
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: ftdi-elan: don't print on ENOMEMWolfram Sang1-1/+0
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: cytherm: don't print on ENOMEMWolfram Sang1-24/+8
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: cypress_cy7c63: don't print on ENOMEMWolfram Sang1-4/+1
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: appledisplay: don't print on ENOMEMWolfram Sang1-3/+0
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-30usb: misc: adutux: don't print on ENOMEMWolfram Sang1-10/+3
All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-21Merge 4.8-rc3 into usb-nextGreg Kroah-Hartman2-9/+10
We want the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: yurex: don't print error when allocating urb failsWolfram Sang1-6/+2
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: uss720: don't print error when allocating urb failsWolfram Sang1-1/+0
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: sisusbvga: sisusb: don't print error when allocating urb failsWolfram Sang1-3/+0
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: lvstest: don't print error when allocating urb failsWolfram Sang1-3/+1
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: legousbtower: don't print error when allocating urb failsWolfram Sang1-6/+2
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: ldusb: don't print error when allocating urb failsWolfram Sang1-6/+2
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: iowarrior: don't print error when allocating urb failsWolfram Sang1-5/+1
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: ftdi-elan: don't print error when allocating urb failsWolfram Sang1-10/+3
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: appledisplay: don't print error when allocating urb failsWolfram Sang1-1/+0
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2016-08-15usb: misc: adutux: don't print error when allocating urb failsWolfram Sang1-6/+2
kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.