Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit feec467f authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge tag 'usb-serial-4.11-rc2' of... 

Merge tag 'usb-serial-4.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial

 into usb-linus

Johan writes:

USB-serial fixes for v4.11-rc2

Here's a fix for a digi_acceleport regression in -rc1, and some fixes
for long-standing issues in three other drivers, including a
NULL-pointer dereference and a couple of information leaks that could be
triggered by a malicious device.

Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
parents 2f682146 8c76d7cd

drivers/usb/serial/io_ti.c

+7 −1
Original line number Diff line number Diff line
@@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(struct urb *urb) 
	function    = TIUMP_GET_FUNC_FROM_CODE(data[0]);

	dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__,

		port_number, function, data[1]);



	if (port_number >= edge_serial->serial->num_ports) {

		dev_err(dev, "bad port number %d\n", port_number);

		goto exit;

	}



	port = edge_serial->serial->port[port_number];

	edge_port = usb_get_serial_port_data(port);

	if (!edge_port) {
@@ -1755,7 +1761,7 @@ static void edge_bulk_in_callback(struct urb *urb) 


	port_number = edge_port->port->port_number;



	if (edge_port->lsr_event) {

	if (urb->actual_length > 0 && edge_port->lsr_event) {

		edge_port->lsr_event = 0;

		dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n",

			__func__, port_number, edge_port->lsr_mask, *data);

drivers/usb/serial/omninet.c

+0 −13
Original line number Diff line number Diff line
@@ -31,7 +31,6 @@ 
#define BT_IGNITIONPRO_ID	0x2000



/* function prototypes */

static int  omninet_open(struct tty_struct *tty, struct usb_serial_port *port);

static void omninet_process_read_urb(struct urb *urb);

static void omninet_write_bulk_callback(struct urb *urb);

static int  omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -60,7 +59,6 @@ static struct usb_serial_driver zyxel_omninet_device = { 
	.attach =		omninet_attach,

	.port_probe =		omninet_port_probe,

	.port_remove =		omninet_port_remove,

	.open =			omninet_open,

	.write =		omninet_write,

	.write_room =		omninet_write_room,

	.write_bulk_callback =	omninet_write_bulk_callback,
@@ -140,17 +138,6 @@ static int omninet_port_remove(struct usb_serial_port *port) 
	return 0;

}



static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)

{

	struct usb_serial	*serial = port->serial;

	struct usb_serial_port	*wport;



	wport = serial->port[1];

	tty_port_tty_set(&wport->port, tty);



	return usb_serial_generic_open(tty, port);

}



#define OMNINET_HEADERLEN	4

#define OMNINET_BULKOUTSIZE	64

#define OMNINET_PAYLOADSIZE	(OMNINET_BULKOUTSIZE - OMNINET_HEADERLEN)

drivers/usb/serial/safe_serial.c

+5 −0
Original line number Diff line number Diff line
@@ -200,6 +200,11 @@ static void safe_process_read_urb(struct urb *urb) 
	if (!safe)

		goto out;



	if (length < 2) {

		dev_err(&port->dev, "malformed packet\n");

		return;

	}



	fcs = fcs_compute10(data, length, CRC10_INITFCS);

	if (fcs) {

		dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs);