linux-toradex.git/include/uapi/linux/usb/ch9.h, branch v4.4.106 Linux kernel for Apalis and Colibri modules USB: core: Add type-specific length check of BOS descriptors 2017-12-09T17:42:44+00:00 Masakazu Mokuno masakazu.mokuno@gmail.com 2017-11-09T16:25:50+00:00 9d812f7bef8c01cd8ca1b57e1e3c3df4bc8ffd34 commit 81cf4a45360f70528f1f64ba018d61cb5767249a upstream. As most of BOS descriptors are longer in length than their header 'struct usb_dev_cap_header', comparing solely with it is not sufficient to avoid out-of-bounds access to BOS descriptors. This patch adds descriptor type specific length check in usb_get_bos_descriptor() to fix the issue. Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 81cf4a45360f70528f1f64ba018d61cb5767249a upstream.

As most of BOS descriptors are longer in length than their header
'struct usb_dev_cap_header', comparing solely with it is not sufficient
to avoid out-of-bounds access to BOS descriptors.

This patch adds descriptor type specific length check in
usb_get_bos_descriptor() to fix the issue.

Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: ch9: Add size macro for SSP dev cap descriptor 2017-12-09T17:42:44+00:00 John Youn John.Youn@synopsys.com 2016-02-06T01:05:12+00:00 f044af8c1dc3f12d933dfae4e51ab2ebab95e5db commit 446fa3a95df1e8b78f25e1babc41e46edd200821 upstream. The SuperspeedPlus Device Capability Descriptor has a variable size depending on the number of sublink speed attributes. This patch adds a macro to calculate that size. The macro takes one argument, the Sublink Speed Attribute Count (SSAC) as reported by the descriptor in bmAttributes[4:0]. See USB 3.1 9.6.2.5, Table 9-19. Signed-off-by: John Youn <johnyoun@synopsys.com> Signed-off-by: Felipe Balbi <balbi@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 446fa3a95df1e8b78f25e1babc41e46edd200821 upstream.

The SuperspeedPlus Device Capability Descriptor has a variable size
depending on the number of sublink speed attributes.

This patch adds a macro to calculate that size. The macro takes one
argument, the Sublink Speed Attribute Count (SSAC) as reported by the
descriptor in bmAttributes[4:0].

See USB 3.1 9.6.2.5, Table 9-19.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: Add USB 3.1 Precision time measurement capability descriptor support 2017-12-09T17:42:43+00:00 Mathias Nyman mathias.nyman@linux.intel.com 2016-02-12T14:40:14+00:00 ddaa1ae2eb7ffb4e270fdc9593c3d1138f61fb31 commit faee822c5a7ab99de25cd34fcde3f8d37b6b9923 upstream. USB 3.1 devices that support precision time measurement have an additional PTM cabaility descriptor as part of the full BOS descriptor Look for this descriptor while parsing the BOS descriptor, and store it in struct usb_hub_bos if it exists. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit faee822c5a7ab99de25cd34fcde3f8d37b6b9923 upstream.

USB 3.1 devices that support precision time measurement have an
additional PTM cabaility descriptor as part of the full BOS descriptor

Look for this descriptor while parsing the BOS descriptor, and store it in
struct usb_hub_bos if it exists.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: fix out-of-bounds in usb_set_configuration 2017-10-12T09:27:33+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2017-09-19T13:07:17+00:00 13713e63bdb306f9a58d359b15edd60f34eac5ee commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream. Andrey Konovalov reported a possible out-of-bounds problem for a USB interface association descriptor. He writes: It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION descriptor. It's only checked that the size is >= 2 in usb_parse_configuration(), so find_iad() might do out-of-bounds access to intf_assoc->bInterfaceCount. And he's right, we don't check for crazy descriptors of this type very well, so resolve this problem. Yet another issue found by syzkaller... Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream.

Andrey Konovalov reported a possible out-of-bounds problem for a USB interface
association descriptor.  He writes:
	It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION
	descriptor. It's only checked that the size is >= 2 in
	usb_parse_configuration(), so find_iad() might do out-of-bounds access
	to intf_assoc->bInterfaceCount.

And he's right, we don't check for crazy descriptors of this type very well, so
resolve this problem.  Yet another issue found by syzkaller...

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices 2016-09-07T06:32:39+00:00 Mathias Nyman mathias.nyman@linux.intel.com 2015-12-10T07:59:25+00:00 dbb9fe1fc7a73bf99976e0cb12fdbd2a0106731c commit 8a1b2725a60d3267135c15e80984b4406054f650 upstream. Add a new USB_SPEED_SUPER_PLUS device speed, and make sure usb core can handle the new speed. In most cases the behaviour is the same as with USB_SPEED_SUPER SuperSpeed devices. In a few places we add a "Plus" string to inform the user of the new speed. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 8a1b2725a60d3267135c15e80984b4406054f650 upstream.

Add a new USB_SPEED_SUPER_PLUS device speed, and make sure usb core can
handle the new speed.
In most cases the behaviour is the same as with USB_SPEED_SUPER SuperSpeed
devices. In a few places we add a "Plus" string to inform the user of the
new speed.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: Add USB 3.1 SuperSpeedPlus device capability descriptor 2015-10-04T09:34:17+00:00 Mathias Nyman mathias.nyman@linux.intel.com 2015-10-01T15:40:32+00:00 90ec9247808ed6b9f072e2c4021868374b0a6d92 USB 3.1 SuperSpeedPlus device capability descriptor is returned as part of the bos descriptor for devices that support SuperSpeedPlus protocol. The descriptor contains more detailed information about the supported speeds of the device. More details about the descriptor can be found in the USB 3.1 specification section 9.6.2.5 Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
USB 3.1 SuperSpeedPlus device capability descriptor is returned as part
of the bos descriptor for devices that support SuperSpeedPlus protocol.

The descriptor contains more detailed information about the supported
speeds of the device. More details about the descriptor can be found in
the USB 3.1 specification section 9.6.2.5

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: add USB_OTG_ADP definition 2015-07-29T14:59:20+00:00 Macpaul Lin macpaul@gmail.com 2015-07-09T07:18:39+00:00 5d701cef9b40188c11c39be3a401bc4feeb154b8 Add USB_OTG_ADP definition for usb_otg_descriptor.bmAttributes. Signed-off-by: Macpaul Lin <macpaul@gmail.com> Signed-off-by: Li Jun <jun.li@freescale.com> Acked-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Felipe Balbi <balbi@ti.com> 
Add USB_OTG_ADP definition for usb_otg_descriptor.bmAttributes.

Signed-off-by: Macpaul Lin <macpaul@gmail.com>
Signed-off-by: Li Jun <jun.li@freescale.com>
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: add usb_otg20_descriptor for OTG 2.0 and above 2015-07-29T14:59:20+00:00 Macpaul Lin macpaul@gmail.com 2015-07-09T07:18:38+00:00 8486a0bba6fc13ae60a8e402cf77c60a7d4e7a04 OTG 2.0 introduces bcdOTG in otg descriptor to identify the OTG and EH supplement release number with which the OTG device is compliant, this patch adds structure usb_otg20_descriptor for OTG 2.0 and above. Signed-off-by: Macpaul Lin <macpaul@gmail.com> Signed-off-by: Li Jun <jun.li@freescale.com> Reviewed-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Felipe Balbi <balbi@ti.com> 
OTG 2.0 introduces bcdOTG in otg descriptor to identify the OTG and EH
supplement release number with which the OTG device is compliant, this
patch adds structure usb_otg20_descriptor for OTG 2.0 and above.

Signed-off-by: Macpaul Lin <macpaul@gmail.com>
Signed-off-by: Li Jun <jun.li@freescale.com>
Reviewed-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
USB: fix an incorrect table index in comment 2013-04-08T16:08:34+00:00 Huang Rui ray.huang@amd.com 2013-04-08T04:20:49+00:00 197c58f624bfb98d3f7f381e57b5d09b2360266f Signed-off-by: Huang Rui <ray.huang@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Signed-off-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: Using correct way to clear usb3.0 device's remote wakeup feature. 2013-01-24T17:58:18+00:00 Lan Tianyu tianyu.lan@intel.com 2013-01-24T02:31:28+00:00 54a3ac0c9e5b7213daa358ce74d154352657353a Usb3.0 device defines function remote wakeup which is only for interface recipient rather than device recipient. This is different with usb2.0 device's remote wakeup feature which is defined for device recipient. According usb3.0 spec 9.4.5, the function remote wakeup can be modified by the SetFeature() requests using the FUNCTION_SUSPEND feature selector. This patch is to use correct way to disable usb3.0 device's function remote wakeup after suspend error and resuming. This should be backported to kernels as old as 3.4, that contain the commit 623bef9e03a60adc623b09673297ca7a1cdfb367 "USB/xhci: Enable remote wakeup for USB3 devices." Signed-off-by: Lan Tianyu <tianyu.lan@intel.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: stable@vger.kernel.org 
Usb3.0 device defines function remote wakeup which is only for interface
recipient rather than device recipient. This is different with usb2.0 device's
remote wakeup feature which is defined for device recipient. According usb3.0
spec 9.4.5, the function remote wakeup can be modified by the SetFeature()
requests using the FUNCTION_SUSPEND feature selector. This patch is to use
correct way to disable usb3.0 device's function remote wakeup after suspend
error and resuming.

This should be backported to kernels as old as 3.4, that contain the
commit 623bef9e03a60adc623b09673297ca7a1cdfb367 "USB/xhci: Enable remote
wakeup for USB3 devices."

Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org