tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'usb-4.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
"Here are some small USB fixes and device ids for 4.15-rc8

Nothing major, small fixes for various devices, some resolutions for
bugs found by fuzzers, and the usual handful of new device ids.

All of these have been in linux-next with no reported issues"

* tag 'usb-4.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
Documentation: usb: fix typo in UVC gadgetfs config command
usb: misc: usb3503: make sure reset is low for at least 100us
uas: ignore UAS for Norelsys NS1068(X) chips
USB: UDC core: fix double-free in usb_add_gadget_udc_release
USB: fix usbmon BUG trigger
usbip: vudc_tx: fix v_send_ret_submit() vulnerability to null xfer buffer
usbip: remove kernel addresses from usb device and urb debug msgs
usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input
USB: serial: cp210x: add new device ID ELV ALC 8xxx
USB: serial: cp210x: add IDs for LifeScan OneTouch Verio IQ

Linus Torvalds 2c1cfa49 d5a047fd

+63 -33
+1 -1
Documentation/usb/gadget-testing.txt
··· 693 693 in each line. The rules stated above are best illustrated with an example: 694 694 695 695 # mkdir functions/uvc.usb0/control/header/h 696 - # cd functions/uvc.usb0/control/header/h 696 + # cd functions/uvc.usb0/control/ 697 697 # ln -s header/h class/fs 698 698 # ln -s header/h class/ss 699 699 # mkdir -p functions/uvc.usb0/streaming/uncompressed/u/360p
+13 -15
drivers/usb/gadget/udc/core.c
··· 1147 1147 1148 1148 udc = kzalloc(sizeof(*udc), GFP_KERNEL); 1149 1149 if (!udc) 1150 - goto err1; 1151 - 1152 - ret = device_add(&gadget->dev); 1153 - if (ret) 1154 - goto err2; 1150 + goto err_put_gadget; 1155 1151 1156 1152 device_initialize(&udc->dev); 1157 1153 udc->dev.release = usb_udc_release; ··· 1156 1160 udc->dev.parent = parent; 1157 1161 ret = dev_set_name(&udc->dev, "%s", kobject_name(&parent->kobj)); 1158 1162 if (ret) 1159 - goto err3; 1163 + goto err_put_udc; 1164 + 1165 + ret = device_add(&gadget->dev); 1166 + if (ret) 1167 + goto err_put_udc; 1160 1168 1161 1169 udc->gadget = gadget; 1162 1170 gadget->udc = udc; ··· 1170 1170 1171 1171 ret = device_add(&udc->dev); 1172 1172 if (ret) 1173 - goto err4; 1173 + goto err_unlist_udc; 1174 1174 1175 1175 usb_gadget_set_state(gadget, USB_STATE_NOTATTACHED); 1176 1176 udc->vbus = true; ··· 1178 1178 /* pick up one of pending gadget drivers */ 1179 1179 ret = check_pending_gadget_drivers(udc); 1180 1180 if (ret) 1181 - goto err5; 1181 + goto err_del_udc; 1182 1182 1183 1183 mutex_unlock(&udc_lock); 1184 1184 1185 1185 return 0; 1186 1186 1187 - err5: 1187 + err_del_udc: 1188 1188 device_del(&udc->dev); 1189 1189 1190 - err4: 1190 + err_unlist_udc: 1191 1191 list_del(&udc->list); 1192 1192 mutex_unlock(&udc_lock); 1193 1193 1194 - err3: 1195 - put_device(&udc->dev); 1196 1194 device_del(&gadget->dev); 1197 1195 1198 - err2: 1199 - kfree(udc); 1196 + err_put_udc: 1197 + put_device(&udc->dev); 1200 1198 1201 - err1: 1199 + err_put_gadget: 1202 1200 put_device(&gadget->dev); 1203 1201 return ret; 1204 1202 }
+2
drivers/usb/misc/usb3503.c
··· 279 279 if (gpio_is_valid(hub->gpio_reset)) { 280 280 err = devm_gpio_request_one(dev, hub->gpio_reset, 281 281 GPIOF_OUT_INIT_LOW, "usb3503 reset"); 282 + /* Datasheet defines a hardware reset to be at least 100us */ 283 + usleep_range(100, 10000); 282 284 if (err) { 283 285 dev_err(dev, 284 286 "unable to request GPIO %d as reset pin (%d)\n",
+7 -1
drivers/usb/mon/mon_bin.c
··· 1004 1004 break; 1005 1005 1006 1006 case MON_IOCQ_RING_SIZE: 1007 + mutex_lock(&rp->fetch_lock); 1007 1008 ret = rp->b_size; 1009 + mutex_unlock(&rp->fetch_lock); 1008 1010 break; 1009 1011 1010 1012 case MON_IOCT_RING_SIZE: ··· 1233 1231 unsigned long offset, chunk_idx; 1234 1232 struct page *pageptr; 1235 1233 1234 + mutex_lock(&rp->fetch_lock); 1236 1235 offset = vmf->pgoff << PAGE_SHIFT; 1237 - if (offset >= rp->b_size) 1236 + if (offset >= rp->b_size) { 1237 + mutex_unlock(&rp->fetch_lock); 1238 1238 return VM_FAULT_SIGBUS; 1239 + } 1239 1240 chunk_idx = offset / CHUNK_SIZE; 1240 1241 pageptr = rp->b_vec[chunk_idx].pg; 1241 1242 get_page(pageptr); 1243 + mutex_unlock(&rp->fetch_lock); 1242 1244 vmf->page = pageptr; 1243 1245 return 0; 1244 1246 }
+2
drivers/usb/serial/cp210x.c
··· 124 124 { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ 125 125 { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ 126 126 { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ 127 + { USB_DEVICE(0x10C4, 0x85A7) }, /* LifeScan OneTouch Verio IQ */ 127 128 { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ 128 129 { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ 129 130 { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ ··· 175 174 { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ 176 175 { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ 177 176 { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ 177 + { USB_DEVICE(0x18EF, 0xE030) }, /* ELV ALC 8xxx Battery Charger */ 178 178 { USB_DEVICE(0x18EF, 0xE032) }, /* ELV TFD500 Data Logger */ 179 179 { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ 180 180 { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
+7
drivers/usb/storage/unusual_uas.h
··· 143 143 USB_SC_DEVICE, USB_PR_DEVICE, NULL, 144 144 US_FL_NO_ATA_1X), 145 145 146 + /* Reported-by: Icenowy Zheng <icenowy@aosc.io> */ 147 + UNUSUAL_DEV(0x2537, 0x1068, 0x0000, 0x9999, 148 + "Norelsys", 149 + "NS1068X", 150 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, 151 + US_FL_IGNORE_UAS), 152 + 146 153 /* Reported-by: Takeo Nakayama <javhera@gmx.com> */ 147 154 UNUSUAL_DEV(0x357d, 0x7788, 0x0000, 0x9999, 148 155 "JMicron",
+3 -14
drivers/usb/usbip/usbip_common.c
··· 91 91 dev_dbg(dev, " devnum(%d) devpath(%s) usb speed(%s)", 92 92 udev->devnum, udev->devpath, usb_speed_string(udev->speed)); 93 93 94 - pr_debug("tt %p, ttport %d\n", udev->tt, udev->ttport); 94 + pr_debug("tt hub ttport %d\n", udev->ttport); 95 95 96 96 dev_dbg(dev, " "); 97 97 for (i = 0; i < 16; i++) ··· 124 124 } 125 125 pr_debug("\n"); 126 126 127 - dev_dbg(dev, "parent %p, bus %p\n", udev->parent, udev->bus); 128 - 129 - dev_dbg(dev, 130 - "descriptor %p, config %p, actconfig %p, rawdescriptors %p\n", 131 - &udev->descriptor, udev->config, 132 - udev->actconfig, udev->rawdescriptors); 127 + dev_dbg(dev, "parent %s, bus %s\n", dev_name(&udev->parent->dev), 128 + udev->bus->bus_name); 133 129 134 130 dev_dbg(dev, "have_langid %d, string_langid %d\n", 135 131 udev->have_langid, udev->string_langid); ··· 233 237 234 238 dev = &urb->dev->dev; 235 239 236 - dev_dbg(dev, " urb :%p\n", urb); 237 - dev_dbg(dev, " dev :%p\n", urb->dev); 238 - 239 240 usbip_dump_usb_device(urb->dev); 240 241 241 242 dev_dbg(dev, " pipe :%08x ", urb->pipe); ··· 241 248 242 249 dev_dbg(dev, " status :%d\n", urb->status); 243 250 dev_dbg(dev, " transfer_flags :%08X\n", urb->transfer_flags); 244 - dev_dbg(dev, " transfer_buffer :%p\n", urb->transfer_buffer); 245 251 dev_dbg(dev, " transfer_buffer_length:%d\n", 246 252 urb->transfer_buffer_length); 247 253 dev_dbg(dev, " actual_length :%d\n", urb->actual_length); 248 - dev_dbg(dev, " setup_packet :%p\n", urb->setup_packet); 249 254 250 255 if (urb->setup_packet && usb_pipetype(urb->pipe) == PIPE_CONTROL) 251 256 usbip_dump_usb_ctrlrequest( ··· 253 262 dev_dbg(dev, " number_of_packets :%d\n", urb->number_of_packets); 254 263 dev_dbg(dev, " interval :%d\n", urb->interval); 255 264 dev_dbg(dev, " error_count :%d\n", urb->error_count); 256 - dev_dbg(dev, " context :%p\n", urb->context); 257 - dev_dbg(dev, " complete :%p\n", urb->complete); 258 265 } 259 266 EXPORT_SYMBOL_GPL(usbip_dump_urb); 260 267
+19
drivers/usb/usbip/vudc_rx.c
··· 120 120 urb_p->new = 1; 121 121 urb_p->seqnum = pdu->base.seqnum; 122 122 123 + if (urb_p->ep->type == USB_ENDPOINT_XFER_ISOC) { 124 + /* validate packet size and number of packets */ 125 + unsigned int maxp, packets, bytes; 126 + 127 + maxp = usb_endpoint_maxp(urb_p->ep->desc); 128 + maxp *= usb_endpoint_maxp_mult(urb_p->ep->desc); 129 + bytes = pdu->u.cmd_submit.transfer_buffer_length; 130 + packets = DIV_ROUND_UP(bytes, maxp); 131 + 132 + if (pdu->u.cmd_submit.number_of_packets < 0 || 133 + pdu->u.cmd_submit.number_of_packets > packets) { 134 + dev_err(&udc->gadget.dev, 135 + "CMD_SUBMIT: isoc invalid num packets %d\n", 136 + pdu->u.cmd_submit.number_of_packets); 137 + ret = -EMSGSIZE; 138 + goto free_urbp; 139 + } 140 + } 141 + 123 142 ret = alloc_urb_from_cmd(&urb_p->urb, pdu, urb_p->ep->type); 124 143 if (ret) { 125 144 usbip_event_add(&udc->ud, VUDC_EVENT_ERROR_MALLOC);
+9 -2
drivers/usb/usbip/vudc_tx.c
··· 85 85 memset(&pdu_header, 0, sizeof(pdu_header)); 86 86 memset(&msg, 0, sizeof(msg)); 87 87 88 + if (urb->actual_length > 0 && !urb->transfer_buffer) { 89 + dev_err(&udc->gadget.dev, 90 + "urb: actual_length %d transfer_buffer null\n", 91 + urb->actual_length); 92 + return -1; 93 + } 94 + 88 95 if (urb_p->type == USB_ENDPOINT_XFER_ISOC) 89 96 iovnum = 2 + urb->number_of_packets; 90 97 else ··· 107 100 108 101 /* 1. setup usbip_header */ 109 102 setup_ret_submit_pdu(&pdu_header, urb_p); 110 - usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n", 111 - pdu_header.base.seqnum, urb); 103 + usbip_dbg_stub_tx("setup txdata seqnum: %d\n", 104 + pdu_header.base.seqnum); 112 105 usbip_header_correct_endian(&pdu_header, 1); 113 106 114 107 iov[iovnum].iov_base = &pdu_header;