| Message ID | 20200113171715.30621-1-johan@kernel.org (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 |
| Headers | show |
| Series | Input: keyspan-remote: fix control-message timeouts | expand |
On Mon, Jan 13, 2020 at 06:17:15PM +0100, Johan Hovold wrote: > The driver was issuing synchronous uninterruptible control requests > without using a timeout. This could lead to the driver hanging on probe > due to a malfunctioning (or malicious) device until the device is > physically disconnected. While sleeping in probe the driver prevents > other devices connected to the same hub from being added to (or removed > from) the bus. > > The USB upper limit of five seconds per request should be more than > enough. > > Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote") > Cc: stable <stable@vger.kernel.org> # 2.6.13 > Signed-off-by: Johan Hovold <johan@kernel.org> > --- > drivers/input/misc/keyspan_remote.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/drivers/input/misc/keyspan_remote.c b/drivers/input/misc/keyspan_remote.c index 83368f1e7c4e..4650f4a94989 100644 --- a/drivers/input/misc/keyspan_remote.c +++ b/drivers/input/misc/keyspan_remote.c @@ -336,7 +336,8 @@ static int keyspan_setup(struct usb_device* dev) int retval = 0; retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), - 0x11, 0x40, 0x5601, 0x0, NULL, 0, 0); + 0x11, 0x40, 0x5601, 0x0, NULL, 0, + USB_CTRL_SET_TIMEOUT); if (retval) { dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n", __func__, retval); @@ -344,7 +345,8 @@ static int keyspan_setup(struct usb_device* dev) } retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), - 0x44, 0x40, 0x0, 0x0, NULL, 0, 0); + 0x44, 0x40, 0x0, 0x0, NULL, 0, + USB_CTRL_SET_TIMEOUT); if (retval) { dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n", __func__, retval); @@ -352,7 +354,8 @@ static int keyspan_setup(struct usb_device* dev) } retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), - 0x22, 0x40, 0x0, 0x0, NULL, 0, 0); + 0x22, 0x40, 0x0, 0x0, NULL, 0, + USB_CTRL_SET_TIMEOUT); if (retval) { dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n", __func__, retval);
The driver was issuing synchronous uninterruptible control requests without using a timeout. This could lead to the driver hanging on probe due to a malfunctioning (or malicious) device until the device is physically disconnected. While sleeping in probe the driver prevents other devices connected to the same hub from being added to (or removed from) the bus. The USB upper limit of five seconds per request should be more than enough. Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote") Cc: stable <stable@vger.kernel.org> # 2.6.13 Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/input/misc/keyspan_remote.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)