From patchwork Fri Mar 22 15:43:55 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 10866125 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 50CFE17EF for ; Fri, 22 Mar 2019 15:46:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3343F2A609 for ; Fri, 22 Mar 2019 15:46:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 277642A8BD; Fri, 22 Mar 2019 15:46:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1C4AC2A609 for ; Fri, 22 Mar 2019 15:46:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727482AbfCVPqe (ORCPT ); Fri, 22 Mar 2019 11:46:34 -0400 Received: from mout.kundenserver.de ([212.227.17.24]:53763 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727231AbfCVPqd (ORCPT ); Fri, 22 Mar 2019 11:46:33 -0400 Received: from wuerfel.lan ([149.172.19.189]) by mrelayeu.kundenserver.de (mreue108 [212.227.15.145]) with ESMTPA (Nemesis) id 1MPGNn-1hLTwE0CPV-00PeTX; Fri, 22 Mar 2019 16:45:47 +0100 From: Arnd Bergmann To: stable@vger.kernel.org, Greg Kroah-Hartman , Kees Cook , Sebastian Andrzej Siewior , "Gustavo A. R. Silva" Cc: Josh Boyer , Ralf Spenneberg , Arnd Bergmann , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BACKPORT 4.4.y 04/25] USB: iowarrior: fix oops with malicious USB descriptors Date: Fri, 22 Mar 2019 16:43:55 +0100 Message-Id: <20190322154425.3852517-5-arnd@arndb.de> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20190322154425.3852517-1-arnd@arndb.de> References: <20190322154425.3852517-1-arnd@arndb.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:qmHMR6/bLkiLAr6Eh2kVU9pjqymM3CZ//BPIzKS9tQMm0ixAiTF UDcP/qFX/IfUNIqGdzDcm3t6cYrK1TzuehVrLBWoIPwmi4QCd79Ub21akCYkHMBqwgaB+ak B2e6Y0ZRK1u/4/qljIYX+imdGR6mUAiKfBTsE+mqTpMSXTgyENA5PtP2Ax4XSCgmAfjTTrS 5tn1Y0+gG5FBJsQHdJNHw== X-UI-Out-Filterresults: notjunk:1;V03:K0:cNE/gt7wInI=:X1hTqeX42BmVm0QmBW7HVM gVZtXD1fAtJajFgUOweHQIUvZnoZL/bhdW4cs8FRpVwEJ6TmJqm8cylXOp9S1qjIPMjLL5J3z Dyu1KubI313MMSs6M/hlMdZRqwcTU8T7T69C2kvNMJFetHZdprrQgerbJF0NT1Q5bPPM5Kkn1 /9A+c9mX+U06ixiHxSAQqKD9GgCBu0iaATVNsxQswp2o+fBbpEhvZE4gy/T5pjhZuzONeXPsk zcT1QaXS+wosEnUdW4K4nQt1iVXrM8GlJBBNnlYJH+9SlQ2BeWY6AKsxSDG0Ng4F4JhH2E946 r2ZkIgF3eE7VUKjtcgTZ3x66RoToNXULPU3KDh49rXEZMxwhqLvvdC6tGWkAUXrPhFV7cO7YI VT5mmijaXuQw8pOuXRsha7wXpuUdqvFZMBYRL7UDVVFIEtMbyn/FAnm6RSSxVyND9gR8XCdgb tTelA15LWI0ypLdoAi67uhWOiF7u0wHQ/UXDgI6FfhICF/4EGZYtwCpTSQQMrLi5Jngj8ED01 Gd5c/KmzwgPlrdv/SAUk0V/i1PCG2X2XQ8azqVLWwriPxA5Klt+h8H+gy5skj4s2TQBayq3yL a0k56Yt0kdAaiG5SfXBVw/1hexum9pgLAx2CA51pPLBwoevmtSmWCanKNgYnBE1Xg9l97e93v jWiiBcWNmDlDZD2GV2R+ShHRji0HLKHKS0FRWJEv3ZZlDHFxYn1PkoTwvO9AiaDCGcnTpNmYm MrqHgTRWq0fHjh/EpZlP2jaxZ9ZbZX2u7tAFNQ== Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Josh Boyer The iowarrior driver expects at least one valid endpoint. If given malicious descriptors that specify 0 for the number of endpoints, it will crash in the probe function. Ensure there is at least one endpoint on the interface before using it. The full report of this issue can be found here: http://seclists.org/bugtraq/2016/Mar/87 Reported-by: Ralf Spenneberg Cc: stable Signed-off-by: Josh Boyer Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 4ec0ef3a82125efc36173062a50624550a900ae0) Signed-off-by: Arnd Bergmann --- drivers/usb/misc/iowarrior.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c index 5e43fd881a9c..381a92a0ebb6 100644 --- a/drivers/usb/misc/iowarrior.c +++ b/drivers/usb/misc/iowarrior.c @@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface, iface_desc = interface->cur_altsetting; dev->product_id = le16_to_cpu(udev->descriptor.idProduct); + if (iface_desc->desc.bNumEndpoints < 1) { + dev_err(&interface->dev, "Invalid number of endpoints\n"); + retval = -EINVAL; + goto error; + } + /* set up the endpoint information */ for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { endpoint = &iface_desc->endpoint[i].desc; From patchwork Fri Mar 22 15:44:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 10866129 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8449713B5 for ; Fri, 22 Mar 2019 15:47:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 66D8028E48 for ; Fri, 22 Mar 2019 15:47:06 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5AB932906F; Fri, 22 Mar 2019 15:47:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ED4052A8BC for ; Fri, 22 Mar 2019 15:47:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727867AbfCVPrF (ORCPT ); Fri, 22 Mar 2019 11:47:05 -0400 Received: from mout.kundenserver.de ([212.227.17.10]:36445 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727244AbfCVPrE (ORCPT ); Fri, 22 Mar 2019 11:47:04 -0400 Received: from wuerfel.lan ([149.172.19.189]) by mrelayeu.kundenserver.de (mreue108 [212.227.15.145]) with ESMTPA (Nemesis) id 1N2E5Q-1h0ShS0wrm-013iJA; Fri, 22 Mar 2019 16:46:48 +0100 From: Arnd Bergmann To: stable@vger.kernel.org, Felipe Balbi , Greg Kroah-Hartman Cc: Roger Quadros , Felipe Balbi , Arnd Bergmann , Thinh Nguyen , Anurag Kumar Vulisha , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BACKPORT 4.4.y 09/25] usb: dwc3: gadget: Fix suspend/resume during device mode Date: Fri, 22 Mar 2019 16:44:00 +0100 Message-Id: <20190322154425.3852517-10-arnd@arndb.de> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20190322154425.3852517-1-arnd@arndb.de> References: <20190322154425.3852517-1-arnd@arndb.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:Wa0NxvaJKz9beWWyK1EmT1GXc1pQUSQRbNYzwZGpDAvrUmOYVYT q3CqinTh9aDABHa0qxK1R/HCGB1KbBMcCZ4Fe1UqQp5zRwBy19SpIOItH5dEX2pbxKvSgFF 2bis02UUdwIjepEi2xBbwSpJ2hFx4+nLB5QVIycTDOHVWwD2Kh6XJ9KNymAD3uVFz0ZGpZ2 Ce7OEFixLoPZbyvrHwDIA== X-UI-Out-Filterresults: notjunk:1;V03:K0:CS48oms4k5w=:vp39lAbh7N7UOKpIVgtHb2 5g3ykR086ja1JLlNtCrAgvl2QwLdKiCbRBfYNF21ciOKlMv17WPa/537erZMitBhSNwPXm99A 2gTX0rvmrp/+4haUYR7bUKtb6c0Uo70r28JLpE4DHPmV64B/o7b1E/6WV5raNX+Pi4vq7pFHJ 2ueU8xm7rlF4d4Wyw/BzvJEuoAh3jzFCEUHRcJ4YJTGaGNFFqUMtwfOVDFvFU6lezU4drF54V Xnljq9Cz4tk2xij/jD+c+J5K8Ie3CrVilqDi4RL1DWWg0gUSpmvSkLTPZhr+sraqXTkEwAcKi hfoYCuQAsBA+lWOit8/PvhWaNiFgE5LBVMa/zvUmc5zBakF+JBnzTljv4B3WRpiGOJt9QacLk bt00+6NwA7CqNo/mRJiL4ST4bx1PdxmcwSzHhWmheyqkA8zwOJlh+NiWZyhPKFcvmfJ27F4JT vcyWAh86VImTYLsdCt/l7sqRIqryRFcic6vmAEYX/4g/iPtx8IexKcdLC2yNLUlTdE9gL4mXd OYvIjDi2wZYhMXFGgc63x4qofteLKsVRCwe8K6EvHCxCfuGrkkc4AqfN6XDBWMDFQaH3cdKzr gyn+hwdDyFlcKsQBNyvEi4vMZMmFVLlLGHQX2HP1A3vpC+FaMz+mKIhcccq2oUnRuLSIN1aHR TE3uxZc/aobrU7F67dA3cElJF1c8fyZbTf1LUHmdli6Up4I65GBtpbWHKO7fDozQBN0O2qpOF 7CvpTRWDpELhDEzviXhKRn7v5bnqcPqhnVYrNg== Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Roger Quadros Gadget controller might not be always active during system suspend/resume as gadget driver might not have yet been loaded or might have been unloaded prior to system suspend. Check if we're active and only then perform necessary actions during suspend/resume. Signed-off-by: Roger Quadros Signed-off-by: Felipe Balbi (cherry picked from commit 9772b47a4c2916d645c551228b6085ea24acbe5d) Signed-off-by: Arnd Bergmann --- drivers/usb/dwc3/gadget.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index b6037a0ae829..58e67c228971 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2893,6 +2893,9 @@ void dwc3_gadget_exit(struct dwc3 *dwc) int dwc3_gadget_suspend(struct dwc3 *dwc) { + if (!dwc->gadget_driver) + return 0; + if (dwc->pullups_connected) { dwc3_gadget_disable_irq(dwc); dwc3_gadget_run_stop(dwc, true, true); @@ -2911,6 +2914,9 @@ int dwc3_gadget_resume(struct dwc3 *dwc) struct dwc3_ep *dep; int ret; + if (!dwc->gadget_driver) + return 0; + /* Start with SuperSpeed Default */ dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(512); From patchwork Fri Mar 22 15:44:06 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 10866143 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2804C139A for ; Fri, 22 Mar 2019 15:48:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0B5E92A8C0 for ; Fri, 22 Mar 2019 15:48:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F391C2A8C3; Fri, 22 Mar 2019 15:48:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3913D2A8C0 for ; Fri, 22 Mar 2019 15:48:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727603AbfCVPr5 (ORCPT ); Fri, 22 Mar 2019 11:47:57 -0400 Received: from mout.kundenserver.de ([212.227.17.24]:57763 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727473AbfCVPr4 (ORCPT ); Fri, 22 Mar 2019 11:47:56 -0400 Received: from wuerfel.lan ([149.172.19.189]) by mrelayeu.kundenserver.de (mreue108 [212.227.15.145]) with ESMTPA (Nemesis) id 1MIdaF-1hARKf0n1p-00EbpP; Fri, 22 Mar 2019 16:47:36 +0100 From: Arnd Bergmann To: stable@vger.kernel.org, Felipe Balbi , Greg Kroah-Hartman Cc: Peter Chen , Felipe Balbi , Arnd Bergmann , Benjamin Herrenschmidt , Chunfeng Yun , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BACKPORT 4.4.y 15/25] usb: gadget: composite: fix dereference after null check coverify warning Date: Fri, 22 Mar 2019 16:44:06 +0100 Message-Id: <20190322154425.3852517-16-arnd@arndb.de> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20190322154425.3852517-1-arnd@arndb.de> References: <20190322154425.3852517-1-arnd@arndb.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:UHzL1C8wGGWp8Z6rjDkjmcHGnCq4ZND0jlzDxvJEFDcI4QzSMpX dsftbYeAGsMIFPD3UOU5TnyF8SXJLoet5YoGqms2eDMcAbOsUXpW4yNA5pRGqiOk0rbsZLX 5D2zbCjflsuGo9WxH+hGNkOkmS9hj+qWw3upfwWO8h/HExl2fLpZWc7ZcXE6JHsQ8uRH4fE OIe92it/gkA8w2+2FL1Rw== X-UI-Out-Filterresults: notjunk:1;V03:K0:v5QA9vpxahI=:qJY+RRUd76611b6rhteEig AsQOUp5bSnEEEzkTdVW9NLcXJ5Cq8jB02RvZYy2O0FEFm60pPUsWk0HP4gHBHTehIW+HMAfBy AFO84IxV+HvBB+ju/QocvQPTE0nboh4Lk226699EBvWpPMO522ULxsZ8q0zcdCgDh+anExwMt +fEk7FN2FKE8FFTvyuyfVLn1HH2xIrm5j0EJUtEq7QVSKCg87HbBzpSB0lBG39gqG3LSlVkc7 VLcf/9POgw3Ee8TmH6QpPHtz2kzEEiwzWOt8ayKALq9+AjQccqS2zZd59jjXmN+KyJ0eVlwdO fMCAPmYmwbp54/xSa9rd4gqTzzPem1W3kVe1zbYso+mutniDwUomwHLYaOiYjAYdj3CSPQQZX FQqAoy4zlNCerzTp0cGrfQ8C6suDk/mumdzBu5Ahzo/FKLcM10+kH1/T9R9FL8KeWjRPmEkYK o/S7V/RCO8izxzeSE84tMkw1couiEVonzKsUsgKY7ajMrHXp/kAoKoxbsaSmblXpLDjuwD7HL mgdj5Gn0hEwp2WHqPHjwLOQXQzyPH/uQH1DC9CjvGZxwWlJb/UyCDUM4y76B7hPEITZLXBKDp j+gx9NHB78d7YbNt/QREUwN+tMhxYw07DUhSeb0wfO4wuqGdb4dZHZE301FjRxPa+a6Sy0/hr oWHRMlHzgGaJuh7/xSWREO4g1vaeZjEXecO9dmDvbnVjLC2bATUujRZ1jK6huBFaJENLIEsw1 R+EO3OqdzB67zjhLnWcsvtenpGK96csHQFvcrg== Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Peter Chen cdev->config is checked for null pointer at above code, so cdev->config might be null, fix it by adding null pointer check. Signed-off-by: Peter Chen Signed-off-by: Felipe Balbi (cherry picked from commit c526c62d565ea5a5bba9433f28756079734f430d) Signed-off-by: Arnd Bergmann --- drivers/usb/gadget/composite.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 58f5fbdb6959..8bf54477f472 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1819,6 +1819,8 @@ unknown: break; case USB_RECIP_ENDPOINT: + if (!cdev->config) + break; endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f); list_for_each_entry(f, &cdev->config->functions, list) { if (test_bit(endp, f->endpoints)) From patchwork Fri Mar 22 15:44:07 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 10866139 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 686EC13B5 for ; Fri, 22 Mar 2019 15:48:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4833B2A8BE for ; Fri, 22 Mar 2019 15:48:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3BA022A8C4; Fri, 22 Mar 2019 15:48:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E0C92A8C1 for ; Fri, 22 Mar 2019 15:48:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728115AbfCVPrw (ORCPT ); Fri, 22 Mar 2019 11:47:52 -0400 Received: from mout.kundenserver.de ([217.72.192.73]:47809 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727509AbfCVPrw (ORCPT ); Fri, 22 Mar 2019 11:47:52 -0400 Received: from wuerfel.lan ([149.172.19.189]) by mrelayeu.kundenserver.de (mreue108 [212.227.15.145]) with ESMTPA (Nemesis) id 1MjjKf-1gjc5b16ZX-00lE5J; Fri, 22 Mar 2019 16:47:44 +0100 From: Arnd Bergmann To: stable@vger.kernel.org, Felipe Balbi , Greg Kroah-Hartman , =?utf-8?b?TWljaGHFgiBNaXJv?= =?utf-8?b?c8WCYXc=?= Cc: Baolin Wang , Felipe Balbi , Arnd Bergmann , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BACKPORT 4.4.y 16/25] usb: gadget: Add the gserial port checking in gs_start_tx() Date: Fri, 22 Mar 2019 16:44:07 +0100 Message-Id: <20190322154425.3852517-17-arnd@arndb.de> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20190322154425.3852517-1-arnd@arndb.de> References: <20190322154425.3852517-1-arnd@arndb.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:Gosm4FGMsO5444Yg2Rf0+LQ/wGhky3Ep9nyBnNCh3iX2HcC7Jqm QRhr2Wo5HVbg+g+U9ybx4brDFsuOPqV7XrvydvCQnY4KLVEkg7chK9/opsptLw/KnBaK7dT 6Ws8K+2CsaWRWoF8ewFtCYh2/J7Tv6abQ5bCXh8/7zQdFfZ1DtMb9E6UD6ccANR3CXSelrD 05HW0XW+xnWmFMNdqqfMQ== X-UI-Out-Filterresults: notjunk:1;V03:K0:sMKRZ0XQZVQ=:m7r/UvufhblTmUzBYkZa5q p4hpUgO2sRWcQOukcKg1UBbA2a+XFUqXPmjT907LUZO9rvBGleAUvIiWLuWNku+4oOmiAvrx+ Z6FPAmd6D/ctYxYRwXN9azzPSqdW4RrehZxWqlrQduuSSacQbIsSZ1N4AYoyNyJzQYwC6BmQ/ nRJGbdnjoHkec07CiGgZE+6quYmo9y8ccATf54sJTC9r1c1nAliTkEuH0mT4yfZ4UXxjWXjgC TUxQaS85HwprcBwB44xlGNMV9aXMJAedeL1LcPu7giVCooKl2g+nfMKRopj2FyLz7wfmDqzKV Ca8IRLmbHpwhdi8tZP5B4XCYiq1tsbqO88RDbKZfWwo+YuBE35reFZjWZOZkTp5WBcKudH3dC 49sRlU6jVz7hHoqZpBBwFA/7gQ8SYSytHfK8NsDd7XGWCIDhFBM5P5vP2eFhVjoTmzNFR3nS2 fVSYqZUPEAHu3Bl6eB+kD/rTjbNwnHL7MsITEe+5nwiNdMHcUJlXEbfjKiE82TVajMjcue5ty nHwawyh8mHiuyXeXhy43p9lbphOK+oKNHrdbQCFki3meHMdldT+cPIYR6DQTwncAr/mBr/00w QWKQnazP6vBd9EI7zjUInvBQtZ2i6JcYznstgP0Ek7n80nidh8V08N+l/2bkpNTiRdrsmQX9r 6W3UO6Eag30fipuj+mDBp1apgRYQshK22Bcz3U4j3wUMcAkCMR0kKaeGg0EH3DiiYdUwTX2At QQiRhmmFr20T5i6fb5s9N8zMq6yOksSjaC6iRw== Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Baolin Wang When usb gadget is set gadget serial function, it will be crash in below situation. It will clean the 'port->port_usb' pointer in gserial_disconnect() function when usb link is inactive, but it will release lock for disabling the endpoints in this function. Druing the lock release period, it maybe complete one request to issue gs_write_complete()--->gs_start_tx() function, but the 'port->port_usb' pointer had been set NULL, thus it will be crash in gs_start_tx() function. This patch adds the 'port->port_usb' pointer checking in gs_start_tx() function to avoid this situation. Signed-off-by: Baolin Wang Signed-off-by: Felipe Balbi (cherry picked from commit 511a36d2f357724312bb3776d2f6eed3890928b2) Signed-off-by: Arnd Bergmann --- drivers/usb/gadget/function/u_serial.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 4ea44f7122ee..d73618475664 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -361,10 +361,15 @@ __acquires(&port->port_lock) */ { struct list_head *pool = &port->write_pool; - struct usb_ep *in = port->port_usb->in; + struct usb_ep *in; int status = 0; bool do_tty_wake = false; + if (!port->port_usb) + return status; + + in = port->port_usb->in; + while (!port->write_busy && !list_empty(pool)) { struct usb_request *req; int len; From patchwork Fri Mar 22 15:44:13 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 10866157 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9466C15AC for ; Fri, 22 Mar 2019 15:50:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 71CB72A8BE for ; Fri, 22 Mar 2019 15:50:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5FB832A8C3; Fri, 22 Mar 2019 15:50:09 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ED7442A8BE for ; Fri, 22 Mar 2019 15:50:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727911AbfCVPuE (ORCPT ); Fri, 22 Mar 2019 11:50:04 -0400 Received: from mout.kundenserver.de ([217.72.192.73]:47715 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725981AbfCVPuE (ORCPT ); Fri, 22 Mar 2019 11:50:04 -0400 Received: from wuerfel.lan ([149.172.19.189]) by mrelayeu.kundenserver.de (mreue108 [212.227.15.145]) with ESMTPA (Nemesis) id 1Mhl8Y-1gTv0W3b4S-00djqU; Fri, 22 Mar 2019 16:49:32 +0100 From: Arnd Bergmann To: stable@vger.kernel.org, Greg Kroah-Hartman , "Gustavo A. R. Silva" , Kees Cook Cc: Yoshihiro Shimoda , Felipe Balbi , Arnd Bergmann , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BACKPORT 4.4.y 22/25] usb: renesas_usbhs: gadget: fix unused-but-set-variable warning Date: Fri, 22 Mar 2019 16:44:13 +0100 Message-Id: <20190322154425.3852517-23-arnd@arndb.de> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20190322154425.3852517-1-arnd@arndb.de> References: <20190322154425.3852517-1-arnd@arndb.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:1zbLgMJ6UdcfbbLrnAhs0F7V3us4vKTcxOwFmyGU0N/10ybZgRE ED53FIXpRAfBiH0ccO5Eu4NWKKW1FG1fcV7qbnsKjkz3rEKK8To833eGkRCIDJ8il+83nKz WeOJIqYfc2n8dB+r24eOPo5mRlXJYKm28MkAL7vF2nI8+H0pFsvuirU5DGCXnsxPoFHlAuD 6xYM7LU5e5oap8/2dt7rg== X-UI-Out-Filterresults: notjunk:1;V03:K0:Yla2KSO6I3c=:Kh9bpEPu/6xf11vu+oSgdr n+vvitCcc4b1sUH8dDiQNX70t3EzOwA/0QK0qvzdK6Y+qZbPSq/rLUnFnqgKNrUzXokYEjgmV gPBv+yliIQq8ds2TePkdEl9Pmz5eOOiq8N93FUuEvlQbsRn9Y79Z23krIrervGjHBHyv0Lukb cqQ8zQiE1ojm7ev7Jr4jd8AndKEcBAmsBGrBR35byduKUlVVXoU2/iWCIasUuwuSsIA5Xtx6+ kvb5RbfbPE8WJYwBjbmmNmk7Rrwqr+ynGFVbLX9nwW0hw6N5AkwBahu1FUbJ/M0oZ4pnPn2rM 1EjETdjtSiBMFaguUF8WxAuX1U76TfNfzvIbjT06eqKS2hLBlUxsYP4zuPRTCNUjyt9FjucXO mXwWr/bp5SIhM101OdP3j5fpR2snI0fNGYBK+CY8mteaun0QZ6V+R/1skH5woPFVNR4IgGh9I qQHfPzP8iPdXxy0Li8ympIWfbspwedhNmpo0uM7pshOCQk1yxrLgl3HPmHPSdSuISJxZjWsZ2 Xe5guXDv+k4u4ENNqKMLqrM+LpoB0q9/nTdskdsBY5cvTDDzDs9rejocQirvUl/IV+HMrGW6r 6DMe+zTngq+JVRIv9r19wzJ/LeLt54Vx2W82WpX+soJ28BgDrrxFcs86zGJyZ2Eth7SjGrqBP 0gcJTC5hatKT6F88rL5ECfoKoOGMIy9erdCKFuKRiFB+8o7HXBUZQPvO3mu4Tjobc/28pHp65 JvgamV00R9JFwb3XR3ntwc8cithK/9ZLLFjKsw== Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Yoshihiro Shimoda The commit b8b9c974afee ("usb: renesas_usbhs: gadget: disable all eps when the driver stops") causes the unused-but-set-variable warning. But, if the usbhsg_ep_disable() will return non-zero value, udc/core.c doesn't clear the ep->enabled flag. So, this driver should not return non-zero value, if the pipe is zero because this means the pipe is already disabled. Otherwise, the ep->enabled flag is never cleared when the usbhsg_ep_disable() is called by the renesas_usbhs driver first. Fixes: b8b9c974afee ("usb: renesas_usbhs: gadget: disable all eps when the driver stops") Fixes: 11432050f070 ("usb: renesas_usbhs: gadget: fix NULL pointer dereference in ep_disable()") Signed-off-by: Yoshihiro Shimoda Signed-off-by: Felipe Balbi (cherry picked from commit b7d44c36a6f6d956e1539e0dd42f98b26e5a4684) Signed-off-by: Arnd Bergmann --- drivers/usb/renesas_usbhs/mod_gadget.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c index 8647d2c2a8c4..c5553028e616 100644 --- a/drivers/usb/renesas_usbhs/mod_gadget.c +++ b/drivers/usb/renesas_usbhs/mod_gadget.c @@ -641,14 +641,11 @@ static int usbhsg_ep_disable(struct usb_ep *ep) struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep); struct usbhs_pipe *pipe; unsigned long flags; - int ret = 0; spin_lock_irqsave(&uep->lock, flags); pipe = usbhsg_uep_to_pipe(uep); - if (!pipe) { - ret = -EINVAL; + if (!pipe) goto out; - } usbhsg_pipe_disable(uep); usbhs_pipe_free(pipe); From patchwork Fri Mar 22 15:44:16 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 10866159 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BCE0315AC for ; Fri, 22 Mar 2019 15:50:27 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A02B62A8BE for ; Fri, 22 Mar 2019 15:50:27 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 93CD02A8C3; Fri, 22 Mar 2019 15:50:27 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 405912A8BE for ; Fri, 22 Mar 2019 15:50:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727782AbfCVPuR (ORCPT ); Fri, 22 Mar 2019 11:50:17 -0400 Received: from mout.kundenserver.de ([212.227.17.24]:40055 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727696AbfCVPuR (ORCPT ); Fri, 22 Mar 2019 11:50:17 -0400 Received: from wuerfel.lan ([149.172.19.189]) by mrelayeu.kundenserver.de (mreue108 [212.227.15.145]) with ESMTPA (Nemesis) id 1N8XLj-1gu9844C3d-014W3f; Fri, 22 Mar 2019 16:50:02 +0100 From: Arnd Bergmann To: stable@vger.kernel.org, Greg Kroah-Hartman , Alan Stern , Suwan Kim , "Gustavo A. R. Silva" Cc: Andrey Konovalov , Arnd Bergmann , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BACKPORT 4.4.y 25/25] USB: core: only clean up what we allocated Date: Fri, 22 Mar 2019 16:44:16 +0100 Message-Id: <20190322154425.3852517-26-arnd@arndb.de> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20190322154425.3852517-1-arnd@arndb.de> References: <20190322154425.3852517-1-arnd@arndb.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:wMbSPcHeSmT84A30VtzrJGakHf9ZFJmOTa7BcDHtx3x+ETBZjeh g1H/1BcB1LCrojY2Jz+mQUWSKoezbqp0L5g+iL2aDa/1oYctHJsCCJTDKta7kganqTUCiGT WbKhG6iBsGx1g/hvksxHEEYIHbL42951pU922HTHUGc825K3zatuFLlhqb1fV0TgtqHMmz0 C55FXJMdjpfPIcCx2UNvg== X-UI-Out-Filterresults: notjunk:1;V03:K0:lwFKb9FP7Ag=:jlGQtNhVji5W71GscMmPXR tuf4mA//DTvfP3p2NjiHpVVvxrCE43li+qSBjKknSL06/G4ocjZE62mANptUCT/+CjP6ut8qZ lY59K8HuRhWsQAkqlLHPC5FdpABgBZKLrOWOcWPG+NLeWrhxldZcBsZECpNavRZmjHMLY6IfH 67E6f597G988MU9VtO4ixky/jn/W1ty6xApNpFVBvF7QsHCc3EN9fQ8XRXVdlwCYh3eKs5sh8 b2LsR+Ja4vHZoArcvWQ0S44Y3tRMyXfs01slU1tncNrjkbCxu5mBgFxdRJY2t9+we50ZGgo71 py9ka778ry8OF1EsAM+b7Cu3/EKg+ZA9Pk4Chj9RO4M7vWFhVI0plzVrd4RtOgmyQXC9/cG5R BsI3nWY0BmtBTltL6dTrxJWj8E/PkORh8t6YEpWNhJB4AbrbfWUS5OzuhZKE2Gio93X0Fwhk4 YHZy0QHTkf8uS8hJWlO51Ykg3QPAcDfXmohlPUtnzMMhlNMkccie8korS0q2qeHlL9VnMeTF6 VowTtsmbW+2wjQEZegYRtgOItZlwI2JqBa0mtJEMhGilHeKMsDdoee8xaW2GamKoabh5rzb3V rkFfg3GgOOmxE3Tur9jkqaSuRkYqo7Ou8yTBVHybhSNQbOwGvf9VAV3yyxNuDxrzXa3Dw4cSA xWhM4DWZupT3PiVVp4tjgV4ER23WtTgsSUGaIo7tofDdeVErCeZzQJFftBaFjpIikxX7u10mG VqfYIeF6jZgR0EO0itBKLSK7IWaxe30qqnBYeA== Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Andrey Konovalov When cleaning up the configurations, make sure we only free the number of configurations and interfaces that we could have allocated. Reported-by: Andrey Konovalov Cc: stable Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3) Signed-off-by: Arnd Bergmann --- drivers/usb/core/config.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 6a287c81a7be..b8eb289e0b17 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -734,18 +734,21 @@ void usb_destroy_configuration(struct usb_device *dev) return; if (dev->rawdescriptors) { - for (i = 0; i < dev->descriptor.bNumConfigurations; i++) + for (i = 0; i < dev->descriptor.bNumConfigurations && + i < USB_MAXCONFIG; i++) kfree(dev->rawdescriptors[i]); kfree(dev->rawdescriptors); dev->rawdescriptors = NULL; } - for (c = 0; c < dev->descriptor.bNumConfigurations; c++) { + for (c = 0; c < dev->descriptor.bNumConfigurations && + c < USB_MAXCONFIG; c++) { struct usb_host_config *cf = &dev->config[c]; kfree(cf->string); - for (i = 0; i < cf->desc.bNumInterfaces; i++) { + for (i = 0; i < cf->desc.bNumInterfaces && + i < USB_MAXINTERFACES; i++) { if (cf->intf_cache[i]) kref_put(&cf->intf_cache[i]->ref, usb_release_interface_cache);