Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a263b16 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'usb-4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 

Pull USB fixes from Greg KH:
 "Here are a handful of USB driver fixes for 4.14-rc5.

  There is the "usual" usb-serial fixes and device ids, USB gadget
  fixes, and some more fixes found by the fuzz testing that is happening
  on the USB layer right now.

  All of these have been in my tree this week with no reported issues"

* tag 'usb-4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: usbtest: fix NULL pointer dereference
  usb: gadget: configfs: Fix memory leak of interface directory data
  usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options
  usb: misc: usbtest: Fix overflow in usbtest_do_ioctl()
  usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
  USB: dummy-hcd: Fix deadlock caused by disconnect detection
  usb: phy: tegra: Fix phy suspend for UDC
  USB: serial: console: fix use-after-free after failed setup
  USB: serial: console: fix use-after-free on disconnect
  USB: serial: qcserial: add Dell DW5818, DW5819
  USB: serial: cp210x: add support for ELV TFD500
  USB: serial: cp210x: fix partnum regression
  USB: serial: option: add support for TP-Link LTE module
  USB: serial: ftdi_sio: add id for Cypress WICED dev board
parents 7a23c5ab 2d30408e

drivers/usb/gadget/composite.c

+5 −0
Original line number Diff line number Diff line
@@ -2026,6 +2026,8 @@ static DEVICE_ATTR_RO(suspended); 
static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)

{

	struct usb_composite_dev	*cdev = get_gadget_data(gadget);

	struct usb_gadget_strings	*gstr = cdev->driver->strings[0];

	struct usb_string		*dev_str = gstr->strings;



	/* composite_disconnect() must already have been called

	 * by the underlying peripheral controller driver!
@@ -2045,6 +2047,9 @@ static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver) 


	composite_dev_cleanup(cdev);



	if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer)

		dev_str[USB_GADGET_MANUFACTURER_IDX].s = "";



	kfree(cdev->def_manufacturer);

	kfree(cdev);

	set_gadget_data(gadget, NULL);

drivers/usb/gadget/configfs.c

+8 −7
Original line number Diff line number Diff line
@@ -1143,7 +1143,8 @@ static struct configfs_attribute *interf_grp_attrs[] = { 
	NULL

};



int usb_os_desc_prepare_interf_dir(struct config_group *parent,

struct config_group *usb_os_desc_prepare_interf_dir(

		struct config_group *parent,

		int n_interf,

		struct usb_os_desc **desc,

		char **names,
@@ -1159,7 +1160,7 @@ int usb_os_desc_prepare_interf_dir(struct config_group *parent, 


	char *vlabuf = kzalloc(vla_group_size(data_chunk), GFP_KERNEL);

	if (!vlabuf)

		return -ENOMEM;

		return ERR_PTR(-ENOMEM);



	os_desc_group = vla_ptr(vlabuf, data_chunk, os_desc_group);

	os_desc_type = vla_ptr(vlabuf, data_chunk, os_desc_type);
@@ -1184,7 +1185,7 @@ int usb_os_desc_prepare_interf_dir(struct config_group *parent, 
		configfs_add_default_group(&d->group, os_desc_group);

	}



	return 0;

	return os_desc_group;

}

EXPORT_SYMBOL(usb_os_desc_prepare_interf_dir);

drivers/usb/gadget/configfs.h

+6 −5
Original line number Diff line number Diff line
@@ -5,7 +5,8 @@ 


void unregister_gadget_item(struct config_item *item);



int usb_os_desc_prepare_interf_dir(struct config_group *parent,

struct config_group *usb_os_desc_prepare_interf_dir(

		struct config_group *parent,

		int n_interf,

		struct usb_os_desc **desc,

		char **names,

drivers/usb/gadget/function/f_rndis.c

+10 −2
Original line number Diff line number Diff line
@@ -908,6 +908,7 @@ static void rndis_free_inst(struct usb_function_instance *f) 
			free_netdev(opts->net);

	}



	kfree(opts->rndis_interf_group);	/* single VLA chunk */

	kfree(opts);

}
@@ -916,6 +917,7 @@ static struct usb_function_instance *rndis_alloc_inst(void) 
	struct f_rndis_opts *opts;

	struct usb_os_desc *descs[1];

	char *names[1];

	struct config_group *rndis_interf_group;



	opts = kzalloc(sizeof(*opts), GFP_KERNEL);

	if (!opts)
@@ -940,8 +942,14 @@ static struct usb_function_instance *rndis_alloc_inst(void) 
	names[0] = "rndis";

	config_group_init_type_name(&opts->func_inst.group, "",

				    &rndis_func_type);

	rndis_interf_group =

		usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,

					       names, THIS_MODULE);

	if (IS_ERR(rndis_interf_group)) {

		rndis_free_inst(&opts->func_inst);

		return ERR_CAST(rndis_interf_group);

	}

	opts->rndis_interf_group = rndis_interf_group;



	return &opts->func_inst;

}

drivers/usb/gadget/function/u_rndis.h

+1 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ struct f_rndis_opts { 
	bool				bound;

	bool				borrowed_net;



	struct config_group		*rndis_interf_group;

	struct usb_os_desc		rndis_os_desc;

	char				rndis_ext_compat_id[16];