linux-toradex.git/drivers/usb/misc, branch v2.6.32.50

USB: uss720 fixup refcount position

2011-03-27T18:30:46+00:00

commit adaa3c6342b249548ea830fe8e02aa5b45be8688 upstream.

My testprog do a lot of bitbang - after hours i got following warning and my machine lockups:
WARNING: at /build/buildd/linux-2.6.38/lib/kref.c:34
After debugging uss720 driver i discovered that the completion callback was called before
usb_submit_urb returns. The callback frees the request structure that is krefed on return by
usb_submit_urb.

Signed-off-by: Peter Holik 
Acked-by: Thomas Sailer 
Signed-off-by: Greg Kroah-Hartman

usb: iowarrior: don't trust report_size for buffer size

2011-03-07T23:17:58+00:00

commit 3ed780117dbe5acb64280d218f0347f238dafed0 upstream.

If the iowarrior devices in this case statement support more than 8 bytes
per report, it is possible to write past the end of a kernel heap allocation.
This will probably never be possible, but change the allocation to be more
defensive anyway.

Signed-off-by: Kees Cook 
Signed-off-by: Greg Kroah-Hartman 
Acked-by: Brandon Philips

USB: misc: uss720.c: add another vendor/product ID

2011-01-07T22:43:15+00:00

commit ecc1624a2fff45780959efbcb73ace18fdb3c58d upstream.

Fabio Battaglia report that he has another cable that works with this
driver, so this patch adds its vendor/product ID.

Signed-off-by: Thomas Sailer 
Signed-off-by: Greg Kroah-Hartman

USB: misc: usbsevseg: fix up some sysfs attribute permissions

2010-12-09T21:26:59+00:00

commit e24d7ace4e822debcb78386bf279c9aba4d7fbd1 upstream.

They should not be writable by any user.

Reported-by: Linus Torvalds 
Cc: Harrison Metzger 
Signed-off-by: Greg Kroah-Hartman

USB: misc: trancevibrator: fix up a sysfs attribute permission

2010-12-09T21:26:58+00:00

commit d489a4b3926bad571d404ca6508f6744b9602776 upstream.

It should not be writable by any user.

Reported-by: Linus Torvalds 
Cc: Sam Hocevar 
Signed-off-by: Greg Kroah-Hartman

USB: misc: usbled: fix up some sysfs attribute permissions

2010-12-09T21:26:57+00:00

commit 48f115470e68d443436b76b22dad63ffbffd6b97 upstream.

They should not be writable by any user.

Reported-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

USB: misc: cypress_cy7c63: fix up some sysfs attribute permissions

2010-12-09T21:26:57+00:00

commit c990600d340641150f7270470a64bd99a5c0b225 upstream.

They should not be writable by any user.

Reported-by: Linus Torvalds 
Cc: Oliver Bock 
Signed-off-by: Greg Kroah-Hartman

usb: misc: iowarrior: fix information leak to userland

2010-12-09T21:26:55+00:00

commit eca67aaeebd6e5d22b0d991af1dd0424dc703bfb upstream.

Structure iowarrior_info is copied to userland with padding byted
between "serial" and "revision" fields uninitialized.  It leads to
leaking of contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov 
Acked-by: Kees Cook 
Signed-off-by: Greg Kroah-Hartman

usb: misc: sisusbvga: fix information leak to userland

2010-12-09T21:26:55+00:00

commit 5dc92cf1d0b4b0debbd2e333b83f9746c103533d upstream.

Structure sisusb_info is copied to userland with "sisusb_reserved" field
uninitialized.  It leads to leaking of contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Greg Kroah-Hartman

USB: usbtest: avoid to free coherent buffer in atomic context

2010-08-13T20:19:45+00:00

commit e10e1bec8e6654de4591ef45ddd6a6d1e5b2591c upstream.

This patch fixes the warning below:
[30753.755998] ------------[ cut here ]------------
[30753.755998] WARNING: at /home/tom/git/linux-2.6/linux-2.6-next/arch/x86/include/asm/dma-mapping.h:155 hcd_buffer_free+0xb1/0xd4 [usbcore]()
[30753.755998] Hardware name: 6475EK2
[30753.755998] Modules linked in: uvcvideo ehci_hcd usbtest cdc_ether usbnet vfat fat usb_storage nfsd lockd nfs_acl auth_rpcgss exportfs mii tun videodev v4l1_compat v4l2_compat_ioctl32 fuse bridge stp llc sunrpc ipv6 cpufreq_ondemand acpi_cpufreq freq_table mperf kvm_intel kvm arc4 ecb ath5k usbhid mac80211 snd_hda_codec_conexant ch341 usbserial ath cfg80211 thinkpad_acpi snd_hda_intel pcspkr wmi hwmon yenta_socket iTCO_wdt iTCO_vendor_support i2c_i801 e1000e snd_hda_codec snd_hwdep snd_pcm snd_timer snd soundcore snd_page_alloc pata_acpi uhci_hcd ohci_hcd usbcore i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: uvcvideo]
[30753.755998] Pid: 0, comm: swapper Tainted: G        W   2.6.35-rc6-gkh-wl+ #49
[30753.755998] Call Trace:
[30753.755998]    [] warn_slowpath_common+0x80/0x98
[30753.755998]  [] warn_slowpath_null+0x15/0x17
[30753.755998]  [] hcd_buffer_free+0xb1/0xd4 [usbcore]
[30753.755998]  [] usb_free_coherent+0x1c/0x1e [usbcore]
[30753.755998]  [] simple_free_urb+0x23/0x2f [usbtest]
[30753.755998]  [] iso_callback+0xbb/0x10f [usbtest]
[30753.755998]  [] usb_hcd_giveback_urb+0x8c/0xc0 [usbcore]
[30753.755998]  [] ehci_urb_done+0x84/0x95 [ehci_hcd]
[30753.755998]  [] ehci_work+0x41a/0x7dd [ehci_hcd]
[30753.755998]  [] ehci_irq+0x33b/0x370 [ehci_hcd]
[30753.755998]  [] ? sched_clock+0x9/0xd
[30753.755998]  [] ? sched_clock_local+0x1c/0x82
[30753.755998]  [] ? sched_clock_cpu+0xc3/0xce
[30753.755998]  [] ? trace_hardirqs_off+0xd/0xf
[30753.755998]  [] ? cpu_clock+0x43/0x5e
[30753.755998]  [] usb_hcd_irq+0x45/0xa1 [usbcore]
[30753.755998]  [] handle_IRQ_event+0x20/0xa5
[30753.755998]  [] handle_fasteoi_irq+0x92/0xd2
[30753.755998]  [] handle_irq+0x1f/0x2a
[30753.755998]  [] do_IRQ+0x57/0xbe
[30753.755998]  [] ret_from_intr+0x0/0x16
[30753.755998]    [] ? acpi_idle_enter_bm+0x231/0x269
[30753.755998]  [] ? acpi_idle_enter_bm+0x22a/0x269
[30753.755998]  [] cpuidle_idle_call+0x99/0xce
[30753.755998]  [] cpu_idle+0x61/0xaa
[30753.755998]  [] start_secondary+0x1c2/0x1c6
[30753.755998] ---[ end trace 904cfaf7ab4cb1a2 ]---

Signed-off-by: Ming Lei 
Signed-off-by: Greg Kroah-Hartman