kernel.git/drivers/usb/core/devio.c, branch linux-2.6.31.y

USB: fix usbfs regression

2010-04-01T22:56:00Z

commit 7152b592593b9d48b33f8997b1dfd6df9143f7ec upstream. This patch (as1352) fixes a bug in the way isochronous input data is returned to userspace for usbfs transfers. The entire buffer must be copied, not just the first actual_length bytes, because the individual packets will be discontiguous if any of them are short. Reported-by: Markus Rechberger Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman

USB: usbfs: only copy the actual data received

2010-04-01T22:55:43Z

commit d4a4683ca054ed9917dfc9e3ff0f7ecf74ad90d6 upstream We need to only copy the data received by the device to userspace, not the whole kernel buffer, which can contain "stale" data. Thanks to Marcus Meissner for pointing this out and testing the fix. Reported-by: Marcus Meissner Tested-by: Marcus Meissner Cc: Alan Stern Cc: Linus Torvalds Cc: stable Signed-off-by: Greg Kroah-Hartman Acked-by: Jeff Mahoney

USB: usbfs: properly clean up the as structure on error paths

2010-04-01T22:55:43Z

commit ddeee0b2eec2a51b0712b04de4b39e7bec892a53 upstream USB: usbfs: properly clean up the as structure on error paths I notice that the processcompl_compat() function seems to be leaking the 'struct async *as' in the error paths. I think that the calling convention is fundamentally buggered. The caller is the one that did the "reap_as()" to get the as thing, the caller should be the one to free it too. Freeing it in the caller also means that it very clearly always gets freed, and avoids the need for any "free in the error case too". From: Linus Torvalds Cc: Alan Stern Cc: Marcus Meissner Cc: stable Signed-off-by: Greg Kroah-Hartman Acked-by: Jeff Mahoney

USB: usbfs: fix -ENOENT error code to be -ENODEV

2009-08-07T23:05:13Z

This patch (as1272) changes the error code returned when an open call for a USB device node fails to locate the corresponding device. The appropriate error code is -ENODEV, not -ENOENT. Signed-off-by: Alan Stern CC: Kay Sievers Cc: stable Signed-off-by: Greg Kroah-Hartman

USB: devio: Properly do access_ok() checks

2009-08-07T23:05:12Z

access_ok() checks must be done on every part of the userspace structure that is accessed. If access_ok() on one part of the struct succeeded, it does not imply it will succeed on other parts of the struct. (Does depend on the architecture implementation of access_ok()). This changes the __get_user() users to first check access_ok() on the data structure. Signed-off-by: Michael Buesch Cc: stable Cc: Pete Zaitcev Signed-off-by: Greg Kroah-Hartman

USB: handle zero-length usbfs submissions correctly

2009-07-12T22:16:41Z

This patch (as1262) fixes a bug in usbfs: It refuses to accept zero-length transfers, and it insists that the buffer pointer be valid even if there is no data being transferred. The patch also consolidates a bunch of repetitive access_ok() checks into a single check, which incidentally fixes the lack of such a check for Isochronous URBs. Signed-off-by: Alan Stern Cc: stable Signed-off-by: Greg Kroah-Hartman

USB: fix race leading to a write after kfree in usbfs

2009-07-12T22:16:40Z

this fixes a race between async_completed() and proc_reapurbnonblock(). CPU A CPU B spin_lock(&ps->lock); list_move_tail(&as->asynclist, &ps->async_completed); spin_unlock(&ps->lock); if (!(as = async_getcompleted(ps))) return -EAGAIN; return processcompl(as, (void __user * __user *)arg); processcompl() calls free_async() which calls kfree(as) as->status = urb->status; if (as->signr) { sinfo.si_signo = as->signr; sinfo.si_errno = as->status; sinfo.si_code = SI_ASYNCIO; sinfo.si_addr = as->userurb; kill_pid_info_as_uid(as->signr, &sinfo, as->pid, as->uid, as->euid, as->secid); } snoop(&urb->dev->dev, "urb complete\n"); snoop_urb(urb, as->userurb); write after kfree Signed-off-by: Oliver Neukum

USB: fix memleak in usbfs

2009-07-12T22:16:39Z

This patch fixes a memory leak in devio.c::processcompl If writing to user space fails the packet must be discarded, as it already has been removed from the queue of completed packets. Signed-off-by: Oliver Neukum Cc: stable Signed-off-by: Greg Kroah-Hartman

USB: add reset endpoint operations

2009-04-17T17:50:27Z

Wireless USB endpoint state has a sequence number and a current window and not just a single toggle bit. So allow HCDs to provide a endpoint_reset method and call this or clear the software toggles as required (after a clear halt, set configuration etc.). usb_settoggle() and friends are then HCD internal and are moved into core/hcd.h and all device drivers call usb_reset_endpoint() instead. If the device endpoint state has been reset (with a clear halt) but the host endpoint state has not then subsequent data transfers will not complete. The device will only work again after it is reset or disconnected. Signed-off-by: David Vrabel Signed-off-by: Greg Kroah-Hartman

USB: more u32 conversion after transfer_buffer_length and actual_length

2009-03-24T23:20:45Z

transfer_buffer_length and actual_length have become unsigned, therefore some additional conversion of local variables, function arguments and print specifications is desired. A test for a negative urb->transfer_buffer_length became obsolete; instead we ensure that it does not exceed INT_MAX. Also, urb->actual_length is always less than urb->transfer_buffer_length. rh_string() does no longer return -EPIPE in the case of an unsupported ID. Instead its only caller, rh_call_control() does the check. Signed-off-by: Roel Kluin Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman