| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.
Signed-off-by: Ignat Korchagin <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
The usbip_protocol.txt, a document which describes usbip's
inner workings is currently located in the projects source
directory (drivers/usb/usbip/...). This patch moves it to
Documentation/usb.
This discussion was brought up by Guy Harris [0] during the
review of the USBIP dissector I wrote. For anyone interested:
support is available with the latest wireshark master/dev tree.
Simply select a packet from the usbip's tcp-stream you are
intrested on and select the USBIP as the protocol in the
"Decode As" dialog box [1].
Signed-off-by: Christian Lamparter <[email protected]>
[0] <https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12127#c2>
[1] <https://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html#ChAdvDecodeAs>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Change spin_lock calls to spin_lock_irqsave to prevent
attmpted recursive lock taking in interrupt context.
This patch fixes Bug 109351
https://bugzilla.kernel.org/show_bug.cgi?id=109351
Signed-off-by: Andrew Goodbody <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
In a situation where the urb is about to be returned or was never
there, we should return -EIDRM (as per usb_hcd_check_unlink_urb).
This is exactly the situation when the urb is picked up by vhci_rx
before we access priv.
Return -EIDRM rather than 0 when this happens.
Signed-off-by: Igor Kotrasinski <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
We handle USB_REQ_SET_ADDRESS at enqueue, so we want to perform
cleanup and giveback the urb. We should not call usb_hcd_giveback_urb
when we're cleaning up after a failed enqueue, though.
Only giveback the urb at cleanup when we claim to have served it.
Signed-off-by: Igor Kotrasinski <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
In big endian cases, macro cpu_to_le16 unfolds to __swab16 which
provides special case for constants. In little endian cases,
__constant_cpu_to_le16 and cpu_to_le16 expand directly to the
same expression. So, replace __constant_cpu_to_le16 with
cpu_to_le16 with the goal of getting rid of the definition of
__constant_cpu_to_le16 completely.
The semantic patch that performs this transformation is as follows:
@@expression x;@@
- __constant_cpu_to_le16(x)
+ cpu_to_le16(x)
Signed-off-by: Vaishali Thakkar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Fix using the bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value is #define'd in <linux/usb/ch11.h>.
Signed-off-by: Sergei Shtylyov <[email protected]>
Acked-by: Valentina Manea <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Fix using the bare number to set the 'wHubCharacteristics' field of the Hub
Descriptor while the values are #define'd in <linux/usb/ch11.h>.
Signed-off-by: Sergei Shtylyov <[email protected]>
Acked-by: Valentina Manea <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull driver core update from Greg KH:
"Here's the set of driver core patches for 3.19-rc1.
They are dominated by the removal of the .owner field in platform
drivers. They touch a lot of files, but they are "simple" changes,
just removing a line in a structure.
Other than that, a few minor driver core and debugfs changes. There
are some ath9k patches coming in through this tree that have been
acked by the wireless maintainers as they relied on the debugfs
changes.
Everything has been in linux-next for a while"
* tag 'driver-core-3.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (324 commits)
Revert "ath: ath9k: use debugfs_create_devm_seqfile() helper for seq_file entries"
fs: debugfs: add forward declaration for struct device type
firmware class: Deletion of an unnecessary check before the function call "vunmap"
firmware loader: fix hung task warning dump
devcoredump: provide a one-way disable function
device: Add dev_<level>_once variants
ath: ath9k: use debugfs_create_devm_seqfile() helper for seq_file entries
ath: use seq_file api for ath9k debugfs files
debugfs: add helper function to create device related seq_file
drivers/base: cacheinfo: remove noisy error boot message
Revert "core: platform: add warning if driver has no owner"
drivers: base: support cpu cache information interface to userspace via sysfs
drivers: base: add cpu_device_create to support per-cpu devices
topology: replace custom attribute macros with standard DEVICE_ATTR*
cpumask: factor out show_cpumap into separate helper function
driver core: Fix unbalanced device reference in drivers_probe
driver core: fix race with userland in device_add()
sysfs/kernfs: make read requests on pre-alloc files use the buffer.
sysfs/kernfs: allow attributes to request write buffer be pre-allocated.
fs: sysfs: return EGBIG on write if offset is larger than file size
...
|
|
If usb_hub_claim_port() fails, no resources are deallocated and
if stub_add_files() fails, port is not released.
The patch fixes these issues and rearranges error handling code.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <[email protected]>
Acked-by: Valentina Manea <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
The usb_put_dev() function tests whether its argument is NULL and then
returns immediately. Thus the test around the call is not needed.
This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <[email protected]>
Acked-by: Valentina Manea <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
A platform_driver does not need to set an owner, it will be populated by the
driver core.
Signed-off-by: Wolfram Sang <[email protected]>
|
|
This was used back when usbip-host was an interface device driver;
after the conversion to device driver, the table remained unused.
Remove it in order to stop receiving a warning about it.
Signed-off-by: Valentina Manea <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
At this point, USB/IP kernel code is fully functional
and can be moved out of staging.
Signed-off-by: Valentina Manea <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|