USB-serial fixes for v4.5-rc2
Here are two fixes of crashes in the visor driver that could be triggered using bad (malicious) descriptors, a fix for two memory leaks in the new mxu11x0 driver, and an interface-blacklist fix for the option driver. Included are also some new device ids. Signed-off-by: Johan Hovold <johan@kernel.org> -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAABCAAGBQJWqi2hAAoJEEEN5E/e4bSV5VQQALpo+SexxQJo4tzl33jaSU03 QMWAqld5UHwmKxzMXOCMg+XBFSfkU3W+EtxrSJl/HCOSWeCveDTvPFEmjgXkfZGq aJvW8bmg/a7lTwk+Fv9For1zlAv0OEpAFv1i9L+U3LI39lUn9eG2OgsOisnnvlww ay0lQ21CH5ta7RVbsTnxpLVWsuvEuhR75pIXKwpvGoGui5KU2HnNDTsjit5Ih9kn dYJZJVozry6xknQ651wHR5jm/40fFJ8J/xmDlJlMxu3Y6CyN8BCGKlM0yc/Qujgz /7Gm52b3qt5EhEvbt+vopg4iy3JhG9S/GNtMGxoUETlqaGz1v2cwUsMTI48yHKP2 ihVVKeRaVrYyoipg9/pKno8bnWouiFdSRm/rmKVl1XltM5Z7il7QTrRscrJflV2L MFKVILrRn78o8tLqkbJbpB1HpPpCXGdsjgv9kMNwb0A/qdiYCWCXWTxPNC1XOA9X t2yOLsD4tGkc3llNvIuDCX9U5gyokff7hY1z01IVbIkCKLxrI3paxGVx1M59QqfE G2QeyC6rJXvev/3EOAQf/r38TqIzaohkTikAJRaMXoGDlWQEGH3JkmnTnY/lSxZS LZCgz7m2JIe/6lUIlM3a0f2SudyCkd0rMnSfO6jzbt/iP56ggPnHS4uAzjaSdMqJ /uQs6Kbamq1d8cqiARwJ =SxKT -----END PGP SIGNATURE----- Merge tag 'usb-serial-4.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for v4.5-rc2 Here are two fixes of crashes in the visor driver that could be triggered using bad (malicious) descriptors, a fix for two memory leaks in the new mxu11x0 driver, and an interface-blacklist fix for the option driver. Included are also some new device ids. Signed-off-by: Johan Hovold <johan@kernel.org>
This commit is contained in:
Greg Kroah-Hartman
commit
a89a798a01
|
|
@ -99,6 +99,7 @@ static const struct usb_device_id id_table[] = {
|
|||
{ USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
|
||||
{ USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
|
||||
{ USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
|
||||
{ USB_DEVICE(0x10C4, 0x81D7) }, /* IAI Corp. RCB-CV-USB USB to RS485 Adaptor */
|
||||
{ USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */
|
||||
{ USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */
|
||||
{ USB_DEVICE(0x10C4, 0x81E8) }, /* Zephyr Bioharness */
|
||||
|
|
|
|||
|
|
@ -824,6 +824,7 @@ static const struct usb_device_id id_table_combined[] = {
|
|||
{ USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID),
|
||||
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
|
||||
{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
|
||||
{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
|
||||
{ USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
|
||||
|
||||
/* Papouch devices based on FTDI chip */
|
||||
|
|
|
|||
|
|
@ -615,6 +615,7 @@
|
|||
*/
|
||||
#define RATOC_VENDOR_ID 0x0584
|
||||
#define RATOC_PRODUCT_ID_USB60F 0xb020
|
||||
#define RATOC_PRODUCT_ID_SCU18 0xb03a
|
||||
|
||||
/*
|
||||
* Infineon Technologies
|
||||
|
|
|
|||
|
|
@ -368,6 +368,16 @@ static int mxu1_port_probe(struct usb_serial_port *port)
|
|||
return 0;
|
||||
}
|
||||
|
||||
static int mxu1_port_remove(struct usb_serial_port *port)
|
||||
{
|
||||
struct mxu1_port *mxport;
|
||||
|
||||
mxport = usb_get_serial_port_data(port);
|
||||
kfree(mxport);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int mxu1_startup(struct usb_serial *serial)
|
||||
{
|
||||
struct mxu1_device *mxdev;
|
||||
|
|
@ -427,6 +437,14 @@ static int mxu1_startup(struct usb_serial *serial)
|
|||
return err;
|
||||
}
|
||||
|
||||
static void mxu1_release(struct usb_serial *serial)
|
||||
{
|
||||
struct mxu1_device *mxdev;
|
||||
|
||||
mxdev = usb_get_serial_data(serial);
|
||||
kfree(mxdev);
|
||||
}
|
||||
|
||||
static int mxu1_write_byte(struct usb_serial_port *port, u32 addr,
|
||||
u8 mask, u8 byte)
|
||||
{
|
||||
|
|
@ -957,7 +975,9 @@ static struct usb_serial_driver mxu11x0_device = {
|
|||
.id_table = mxu1_idtable,
|
||||
.num_ports = 1,
|
||||
.port_probe = mxu1_port_probe,
|
||||
.port_remove = mxu1_port_remove,
|
||||
.attach = mxu1_startup,
|
||||
.release = mxu1_release,
|
||||
.open = mxu1_open,
|
||||
.close = mxu1_close,
|
||||
.ioctl = mxu1_ioctl,
|
||||
|
|
|
|||
|
|
@ -268,6 +268,8 @@ static void option_instat_callback(struct urb *urb);
|
|||
#define TELIT_PRODUCT_CC864_SINGLE 0x1006
|
||||
#define TELIT_PRODUCT_DE910_DUAL 0x1010
|
||||
#define TELIT_PRODUCT_UE910_V2 0x1012
|
||||
#define TELIT_PRODUCT_LE922_USBCFG0 0x1042
|
||||
#define TELIT_PRODUCT_LE922_USBCFG3 0x1043
|
||||
#define TELIT_PRODUCT_LE920 0x1200
|
||||
#define TELIT_PRODUCT_LE910 0x1201
|
||||
|
||||
|
|
@ -615,6 +617,16 @@ static const struct option_blacklist_info telit_le920_blacklist = {
|
|||
.reserved = BIT(1) | BIT(5),
|
||||
};
|
||||
|
||||
static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
|
||||
.sendsetup = BIT(2),
|
||||
.reserved = BIT(0) | BIT(1) | BIT(3),
|
||||
};
|
||||
|
||||
static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = {
|
||||
.sendsetup = BIT(0),
|
||||
.reserved = BIT(1) | BIT(2) | BIT(3),
|
||||
};
|
||||
|
||||
static const struct usb_device_id option_ids[] = {
|
||||
{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
|
||||
{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
|
||||
|
|
@ -1160,6 +1172,10 @@ static const struct usb_device_id option_ids[] = {
|
|||
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
|
||||
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
|
||||
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
|
||||
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
|
||||
.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
|
||||
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3),
|
||||
.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
|
||||
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
|
||||
.driver_info = (kernel_ulong_t)&telit_le910_blacklist },
|
||||
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
|
||||
|
|
@ -1679,7 +1695,7 @@ static const struct usb_device_id option_ids[] = {
|
|||
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
|
||||
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
|
||||
.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
|
||||
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
|
||||
{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) },
|
||||
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
|
||||
.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
|
||||
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
|
||||
|
|
|
|||
|
|
@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial)
|
|||
(serial->num_interrupt_in == 0))
|
||||
return 0;
|
||||
|
||||
if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) {
|
||||
dev_err(&serial->interface->dev, "missing endpoints\n");
|
||||
return -ENODEV;
|
||||
}
|
||||
|
||||
/*
|
||||
* It appears that Treos and Kyoceras want to use the
|
||||
* 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,
|
||||
|
|
@ -597,8 +602,10 @@ static int clie_5_attach(struct usb_serial *serial)
|
|||
*/
|
||||
|
||||
/* some sanity check */
|
||||
if (serial->num_ports < 2)
|
||||
return -1;
|
||||
if (serial->num_bulk_out < 2) {
|
||||
dev_err(&serial->interface->dev, "missing bulk out endpoints\n");
|
||||
return -ENODEV;
|
||||
}
|
||||
|
||||
/* port 0 now uses the modified endpoint Address */
|
||||
port = serial->port[0];
|
||||
|
|
|
|||
Loading…
Reference in New Issue