tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'usb-5.17-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
"Here are some small remaining USB fixes for 5.17-final.

They include:

- two USB gadget driver fixes for reported problems

- usbtmc driver fix for syzbot found issues

- musb patch partial revert to resolve a reported regression.

All of these have been in linux-next this week with no reported
problems"

* tag 'usb-5.17-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
usb: usbtmc: Fix bug in pipe direction for control transfers
partially Revert "usb: musb: Set the DT node on the child device"
usb: gadget: rndis: prevent integer overflow in rndis_set_response()

Linus Torvalds 6aa61c12 34e047aa

+11 -7
+10 -3
drivers/usb/class/usbtmc.c
··· 1919 1919 struct usbtmc_ctrlrequest request; 1920 1920 u8 *buffer = NULL; 1921 1921 int rv; 1922 + unsigned int is_in, pipe; 1922 1923 unsigned long res; 1923 1924 1924 1925 res = copy_from_user(&request, arg, sizeof(struct usbtmc_ctrlrequest)); ··· 1929 1928 if (request.req.wLength > USBTMC_BUFSIZE) 1930 1929 return -EMSGSIZE; 1931 1930 1931 + is_in = request.req.bRequestType & USB_DIR_IN; 1932 + 1932 1933 if (request.req.wLength) { 1933 1934 buffer = kmalloc(request.req.wLength, GFP_KERNEL); 1934 1935 if (!buffer) 1935 1936 return -ENOMEM; 1936 1937 1937 - if ((request.req.bRequestType & USB_DIR_IN) == 0) { 1938 + if (!is_in) { 1938 1939 /* Send control data to device */ 1939 1940 res = copy_from_user(buffer, request.data, 1940 1941 request.req.wLength); ··· 1947 1944 } 1948 1945 } 1949 1946 1947 + if (is_in) 1948 + pipe = usb_rcvctrlpipe(data->usb_dev, 0); 1949 + else 1950 + pipe = usb_sndctrlpipe(data->usb_dev, 0); 1950 1951 rv = usb_control_msg(data->usb_dev, 1951 - usb_rcvctrlpipe(data->usb_dev, 0), 1952 + pipe, 1952 1953 request.req.bRequest, 1953 1954 request.req.bRequestType, 1954 1955 request.req.wValue, ··· 1964 1957 goto exit; 1965 1958 } 1966 1959 1967 - if (rv && (request.req.bRequestType & USB_DIR_IN)) { 1960 + if (rv && is_in) { 1968 1961 /* Read control data from device */ 1969 1962 res = copy_to_user(request.data, buffer, rv); 1970 1963 if (res)
+1
drivers/usb/gadget/function/rndis.c
··· 640 640 BufLength = le32_to_cpu(buf->InformationBufferLength); 641 641 BufOffset = le32_to_cpu(buf->InformationBufferOffset); 642 642 if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || 643 + (BufOffset > RNDIS_MAX_TOTAL_SIZE) || 643 644 (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) 644 645 return -EINVAL; 645 646
-3
drivers/usb/gadget/udc/core.c
··· 1436 1436 usb_gadget_udc_stop(udc); 1437 1437 1438 1438 udc->driver = NULL; 1439 - udc->dev.driver = NULL; 1440 1439 udc->gadget->dev.driver = NULL; 1441 1440 } 1442 1441 ··· 1497 1498 driver->function); 1498 1499 1499 1500 udc->driver = driver; 1500 - udc->dev.driver = &driver->driver; 1501 1501 udc->gadget->dev.driver = &driver->driver; 1502 1502 1503 1503 usb_gadget_udc_set_speed(udc, driver->max_speed); ··· 1519 1521 dev_err(&udc->dev, "failed to start %s: %d\n", 1520 1522 udc->driver->function, ret); 1521 1523 udc->driver = NULL; 1522 - udc->dev.driver = NULL; 1523 1524 udc->gadget->dev.driver = NULL; 1524 1525 return ret; 1525 1526 }
-1
drivers/usb/musb/omap2430.c
··· 327 327 musb->dev.parent = &pdev->dev; 328 328 musb->dev.dma_mask = &omap2430_dmamask; 329 329 musb->dev.coherent_dma_mask = omap2430_dmamask; 330 - device_set_of_node_from_dev(&musb->dev, &pdev->dev); 331 330 332 331 glue->dev = &pdev->dev; 333 332 glue->musb = musb;