summaryrefslogtreecommitdiffstats
path: root/drivers/usb/misc
Commit message (Collapse)AuthorAgeFilesLines
* USB: uss720: fix NULL-deref at probeJohan Hovold2017-03-141-0/+5
| | | | | | | | | | | | | | | | | Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints. Note that the endpoint access that causes the NULL-deref is currently only used for debugging purposes during probe so the oops only happens when dynamic debugging is enabled. This means the driver could be rewritten to continue to accept device with only two endpoints, should such devices exist. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* USB: lvtest: fix NULL-deref at probeJohan Hovold2017-03-141-0/+4
| | | | | | | | | | | | | Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should the probed device lack endpoints. Note that this driver does not bind to any devices by default. Fixes: ce21bfe603b3 ("USB: Add LVS Test device driver") Cc: stable <stable@vger.kernel.org> # 3.17 Cc: Pratyush Anand <pratyush.anand@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* USB: idmouse: fix NULL-deref at probeJohan Hovold2017-03-141-0/+3
| | | | | | | | | | Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: usb251xb: dt: add unit suffix to oc-delay and power-on-timeRichard Leitner2017-03-091-15/+20
| | | | | | | | | Rename oc-delay-* to oc-delay-us and make it expect a time value. Furthermore add -ms suffix to power-on-time. There changes were suggested by Rob Herring in https://lkml.org/lkml/2017/2/15/1283. Signed-off-by: Richard Leitner <richard.leitner@skidata.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: usb251xb: remove max_{power,current}_{sp,bp} propertiesRichard Leitner2017-03-091-20/+4
| | | | | | | | | | | Remove the max_{power,current}_{sp,bp} properties of the usb251xb driver from devicetree. This is done to simplify the dt bindings as requested by Rob Herring in https://lkml.org/lkml/2017/2/15/1283. If those properties are ever needed by somebody they can be enabled again easily. Signed-off-by: Richard Leitner <richard.leitner@skidata.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* USB: iowarrior: fix NULL-deref in writeJohan Hovold2017-03-091-0/+8
| | | | | | | | | | | Make sure to verify that we have the required interrupt-out endpoint for IOWarrior56 devices to avoid dereferencing a NULL-pointer in write should a malicious device lack such an endpoint. Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable <stable@vger.kernel.org> # 2.6.21 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* USB: iowarrior: fix NULL-deref at probeJohan Hovold2017-03-091-6/+7
| | | | | | | | | | | | | | | | Make sure to check for the required interrupt-in endpoint to avoid dereferencing a NULL-pointer should a malicious device lack such an endpoint. Note that a fairly recent change purported to fix this issue, but added an insufficient test on the number of endpoints only, a test which can now be removed. Fixes: 4ec0ef3a8212 ("USB: iowarrior: fix oops with malicious USB descriptors") Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable <stable@vger.kernel.org> # 2.6.21 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* sched/headers: Prepare to move signal wakeup & sigpending methods from ↵Ingo Molnar2017-03-024-1/+4
| | | | | | | | | | | | | <linux/sched.h> into <linux/sched/signal.h> Fix up affected files that include this signal functionality via sched.h. Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mike Galbraith <efault@gmx.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
* lib/vsprintf.c: remove %Z supportAlexey Dobriyan2017-02-273-8/+8
| | | | | | | | | | | | | | | | | | Now that %z is standartised in C99 there is no reason to support %Z. Unlike %L it doesn't even make format strings smaller. Use BUILD_BUG_ON in a couple ATM drivers. In case anyone didn't notice lib/vsprintf.o is about half of SLUB which is in my opinion is quite an achievement. Hopefully this patch inspires someone else to trim vsprintf.c more. Link: http://lkml.kernel.org/r/20170103230126.GA30170@avx2 Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Cc: Andy Shevchenko <andy.shevchenko@gmail.com> Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* usb: misc: add USB251xB/xBi Hi-Speed Hub Controller DriverRichard Leitner2017-02-143-0/+615
| | | | | | | | | | | | | | | | | This patch adds a driver for configuration of the Microchip USB251xB/xBi USB 2.0 hub controller series with USB 2.0 upstream connectivity, SMBus configuration interface and two to four USB 2.0 downstream ports. Furthermore add myself as a maintainer for this driver. The datasheet can be found at the manufacturers website, see [1]. All device-tree exposed configuration features have been tested on a i.MX6 platform with a USB2512B hub. [1] http://ww1.microchip.com/downloads/en/DeviceDoc/00001692C.pdf Signed-off-by: Richard Leitner <richard.leitner@skidata.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: usbtest: remove redundant check on retval < 0Colin Ian King2017-02-141-1/+1
| | | | | | | | | | | | The check for retval being less than zero is always true since retval equal to -EPIPE at that point. Replace the existing conditional with just return retval. Detected with CoverityScan, CID#114349 ("Logically dead code") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* drivers: usb-misc: sisusbvga: remove dead codeGustavo A. R. Silva2017-02-081-6/+0
| | | | | | | | | | The condition modex % 16 cannot be true when modex value is equal to 640 The condition du & 0xff cannot be true when du value is equal to 0x1400 Addresses-Coverity-Id: 101163 Addresses-Coverity-Id: 744373 Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: adutux: remove redundant error check on copy_to_user return codeColin Ian King2017-02-031-4/+0
| | | | | | | | | | | | | | The 2nd check for a non-zero return from copy_to_user is redundant as it is has already been made a few lines earlier. This check was made redundant because of previous fix to the copy_to_user error return check. Detected by CoverityScan, CID#114347 ("Logically Dead Code") Fixes: 1865a9c382ede ("USB: adutux: fix misuse of return value of copy_to_user()") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Replace <asm/uaccess.h> with <linux/uaccess.h> globallyLinus Torvalds2016-12-244-4/+4
| | | | | | | | | | | | | This was entirely automated, using the script by Al: PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*<asm/uaccess.h>' sed -i -e "s!$PATT!#include <linux/uaccess.h>!" \ $(git grep -l "$PATT"|grep -v ^include/linux/uaccess.h) to do the replacement at the end of the merge window. Requested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge tag 'tty-4.10-rc1' of ↵Linus Torvalds2016-12-131-43/+12
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here's the tty/serial patchset for 4.10-rc1. It's been a quiet kernel cycle for this subsystem, just a small number of changes. A few new serial drivers, and some cleanups to the old vgacon logic, and other minor serial driver changes as well. All of these have been in linux-next for a while with no reported issues" * tag 'tty-4.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (54 commits) serial: 8250_mid fix calltrace when hotplug 8250 serial controller console: Move userspace I/O out of console_lock to fix lockdep warning tty: nozomi: avoid sprintf buffer overflow serial: 8250_pci: Detach low-level driver during PCI error recovery serial: core: don't check port twice in a row mxs-auart: count FIFO overrun errors serial: 8250_dw: Add support for IrDA SIR mode serial: 8250: Expose set_ldisc function serial: 8250: Add IrDA to UART capabilities serial: 8250_dma: power off device after TX is done serial: 8250_port: export serial8250_rpm_{get|put}_tx() serial: sunsu: Free memory when probe fails serial: sunhv: Free memory when remove() is called vt: fix Scroll Lock LED trigger name tty: typo in comments in drivers/tty/vt/keyboard.c tty: amba-pl011: Add earlycon support for SBSA UART tty: nozomi: use permission-specific DEVICE_ATTR variants tty: serial: Make the STM32 serial port depend on it's arch serial: ifx6x60: Free memory when probe fails serial: ioc4_serial: Free memory when kzalloc fails during probe ...
| * tty: vgacon+sisusb, move scrolldelta to a common helperJiri Slaby2016-10-271-35/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code is mirrorred in scrolldelta implementations of both vgacon and sisusb. Let's move the code to a separate helper where we will perform a common cleanup and further changes. While we are moving the code, make it linear and save one indentation level. This is done by returning from the "!lines" then-branch immediatelly. This allows flushing the else-branch 1 level to the left, obviously. Few more new lines and comments were added too. And do not forget to export the helper function given sisusb can be built as module. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Thomas Winischhofer <thomas@winischhofer.net> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: <linux-fbdev@vger.kernel.org> Cc: <linux-usb@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * tty: vt, cleanup and document con_scrollJiri Slaby2016-10-271-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Scrolling helpers scrup and scrdown both accept 'top' and 'bottom' as unsigned int. Number of lines 'nr' is accepted as int, but all callers pass down unsigned too. So change the type of 'nr' to unsigned too. Now, promote unsigned int from the helpers up to the con_scroll hook which actually accepted all those as signed int. Next, the 'dir' parameter can have only two values and we define constants for that: SM_UP and SM_DOWN. Switch them to enum and do proper type checking on 'dir' too. Finally, document the behaviour of the hook. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Thomas Winischhofer <thomas@winischhofer.net> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: "James E.J. Bottomley" <jejb@parisc-linux.org> Cc: Helge Deller <deller@gmx.de> Cc: <linux-fbdev@vger.kernel.org> Cc: <linux-usb@vger.kernel.org> Cc: <linux-parisc@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | usb: misc: rio500: fix result type for error messageKim Jae Joong2016-12-081-1/+1
| | | | | | | | | | | | | | Fix variable type for dev_err about usb_bulk_msg() Signed-off-by: Kim Jae Joong <climbbb.kim@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge tag 'usb-for-v4.10' of ↵Greg Kroah-Hartman2016-11-181-3/+3
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next Felipe writes: usb: patches for v4.10 merge window One big merge this time with a total of 166 non-merge commits. Most of the work, by far, is on dwc2 this time (68.2%) with dwc3 a far second (22.5%). The remaining 9.3% are scattered on gadget drivers. The most important changes for dwc2 are the peripheral side DMA support implemented by Synopsys folks and support for the new IOT dwc2 compatible core from Synopsys. In dwc3 land we have support for high-bandwidth, high-speed isochronous endpoints and some non-critical fixes for large scatter lists. Apart from these, we have our usual set of cleanups, non-critical fixes, etc.
| * | usb: misc: usbtest: remove unnecessary & operationFelipe Balbi2016-11-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Now that usb_endpoint_maxp() only returns the lowest 11 bits from wMaxPacketSize, we can remove the & operation from this driver. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| * | usb: misc: usbtest: make use of new usb_endpoint_maxp_mult()Felipe Balbi2016-11-031-2/+2
| |/ | | | | | | | | | | | | We have introduced a helper to calculate multiplier value from wMaxPacketSize. Start using it. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* | hwrng: chaoskey - drop workaround for old hwrng core limitationJulien Cristau2016-10-241-13/+1
|/ | | | | | | | | | The hwrng core used to mask 'quality' with 1023; that has been removed in commit 506bf0c0464ace57169aadcf02ae397999c57bdd ("hwrng: core - allow perfect entropy from hardware devices"), so we can now just set quality to 1024. Signed-off-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: legousbtower: Fix NULL pointer deferenceGreg Kroah-Hartman2016-09-211-18/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a NULL pointer dereference caused by a race codition in the probe function of the legousbtower driver. It re-structures the probe function to only register the interface after successfully reading the board's firmware ID. The probe function does not deregister the usb interface after an error receiving the devices firmware ID. The device file registered (/dev/usb/legousbtower%d) may be read/written globally before the probe function returns. When tower_delete is called in the probe function (after an r/w has been initiated), core dev structures are deleted while the file operation functions are still running. If the 0 address is mappable on the machine, this vulnerability can be used to create a Local Priviege Escalation exploit via a write-what-where condition by remapping dev->interrupt_out_buffer in tower_write. A forged USB device and local program execution would be required for LPE. The USB device would have to delay the control message in tower_probe and accept the control urb in tower_open whilst guest code initiated a write to the device file as tower_delete is called from the error in tower_probe. This bug has existed since 2003. Patch tested by emulated device. Reported-by: James Patrick-Evans <james@jmp-e.com> Tested-by: James Patrick-Evans <james@jmp-e.com> Signed-off-by: James Patrick-Evans <james@jmp-e.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* ezusb: constify local structuresJulia Lawall2016-09-131-1/+1
| | | | | | | | | | | | | | | | | | For structure types defined in the same file or local header files, find top-level static structure declarations that have the following properties: 1. Never reassigned. 2. Address never taken 3. Not passed to a top-level macro call 4. No pointer or array-typed field passed to a function or stored in a variable. Declare structures having all of these properties as const. Done using Coccinelle. Based on a suggestion by Joe Perches <joe@perches.com>. Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: yurex: don't print on ENOMEMWolfram Sang2016-08-301-6/+2
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: uss720: don't print on ENOMEMWolfram Sang2016-08-301-3/+1
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: usbsevseg: don't print on ENOMEMWolfram Sang2016-08-301-6/+2
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: usblcd: don't print on ENOMEMWolfram Sang2016-08-301-7/+2
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: trancevibrator: don't print on ENOMEMWolfram Sang2016-08-301-2/+1
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: lvstest: don't print on ENOMEMWolfram Sang2016-08-301-3/+1
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: legousbtower: don't print on ENOMEMWolfram Sang2016-08-301-12/+4
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: ldusb: don't print on ENOMEMWolfram Sang2016-08-301-15/+5
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: iowarrior: don't print on ENOMEMWolfram Sang2016-08-301-14/+6
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: idmouse: don't print on ENOMEMWolfram Sang2016-08-301-1/+0
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: ftdi-elan: don't print on ENOMEMWolfram Sang2016-08-301-1/+0
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: cytherm: don't print on ENOMEMWolfram Sang2016-08-301-24/+8
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: cypress_cy7c63: don't print on ENOMEMWolfram Sang2016-08-301-4/+1
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: appledisplay: don't print on ENOMEMWolfram Sang2016-08-301-3/+0
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* usb: misc: adutux: don't print on ENOMEMWolfram Sang2016-08-301-10/+3
| | | | | | | All kmalloc-based functions print enough information on failures. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Merge 4.8-rc3 into usb-nextGreg Kroah-Hartman2016-08-212-9/+10
|\ | | | | | | | | | | We want the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: misc: usbtest: add fix for driver hangLu Baolu2016-08-111-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In sg_timeout(), req->status is set to "-ETIMEDOUT" before calling into usb_sg_cancel(). usb_sg_cancel() will do nothing and return directly if req->status has been set to a non-zero value. This will cause driver hang whenever transfer time out is triggered. This patch fixes this issue. It could be backported to stable kernel with version later than v3.15. Cc: stable@vger.kernel.org # 3.15+ Cc: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Suggested-by: Alan Stern <stern@rowland.harvard.edu> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: misc: ftdi-elan: Fix off-by-one memory corruptionsXiao Han2016-08-091-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes fives off-by-one bugs in the ftdi-elan driver code. The bug can be triggered by plugging a USB adapter for CardBus 3G cards (model U132 manufactured by Elan Digital Systems, Ltd), causing a kernel panic. The fix was tested on Ubuntu 14.04.4 with 4.7.0-rc14.2.0-27-generic+ and 4.4.0-22-generic+ kernel. In the ftdi_elan_synchronize function, an off-by-one memory corruption occurs when packet_bytes is equal or bigger than m. After having read m bytes, that is bytes_read is equal to m, " ..\x00" is still copied to the stack variable causing an out bounds write of 4 bytes, which overwrites the stack canary and results in a kernel panic. This off-by-one requires physical access to the machine. It is not exploitable since we have no control on the overwritten data. Similar off-by-one bugs have been observed in 4 other functions: ftdi_elan_stuck_waiting, ftdi_elan_read, ftdi_elan_edset_output and ftdi_elan_flush_input_fifo. Reported-by: Alex Palesandro <palexster@gmail.com> Signed-off-by: Xiao Han <xiao.han@orange.fr> Tested-by: Paul Chaignon <pchaigno@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: misc: usbtest: usbtest_do_ioctl may return positive integerPeter Chen2016-08-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | For case 14 and case 21, their correct return value is the number of bytes transferred, so it is a positive integer. But in usbtest_ioctl, it takes non-zero as false return value for usbtest_do_ioctl, so it will treat the correct test as wrong test, then the time on tests will be the minus value. Signed-off-by: Peter Chen <peter.chen@nxp.com> Cc: stable <stable@vger.kernel.org> Fixes: 18fc4ebdc705 ("usb: misc: usbtest: Remove timeval usage") Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | usb: misc: yurex: don't print error when allocating urb failsWolfram Sang2016-08-151-6/+2
| | | | | | | | | | | | | | kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | usb: misc: uss720: don't print error when allocating urb failsWolfram Sang2016-08-151-1/+0
| | | | | | | | | | | | | | kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | usb: misc: sisusbvga: sisusb: don't print error when allocating urb failsWolfram Sang2016-08-151-3/+0
| | | | | | | | | | | | | | kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | usb: misc: lvstest: don't print error when allocating urb failsWolfram Sang2016-08-151-3/+1
| | | | | | | | | | | | | | kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | usb: misc: legousbtower: don't print error when allocating urb failsWolfram Sang2016-08-151-6/+2
| | | | | | | | | | | | | | kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | usb: misc: ldusb: don't print error when allocating urb failsWolfram Sang2016-08-151-6/+2
| | | | | | | | | | | | | | kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | usb: misc: iowarrior: don't print error when allocating urb failsWolfram Sang2016-08-151-5/+1
| | | | | | | | | | | | | | kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
OpenPOWER on IntegriCloud