kernel.git/drivers/usb/gadget/function/rndis.c, branch linux-4.9.y

usb: gadget: rndis: prevent integer overflow in rndis_set_response()

2022-03-23T08:00:34Z

commit 65f3324f4b6fed78b8761c3b74615ecf0ffa81fa upstream. If "BufOffset" is very large the "BufOffset + 8" operation can have an integer overflow. Cc: stable@kernel.org Fixes: 38ea1eac7d88 ("usb: gadget: rndis: check size of RNDIS_MSG_SET command") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20220301080424.GA17208@kili Signed-off-by: Greg Kroah-Hartman

usb: gadget: rndis: add spinlock for rndis response list

2022-03-02T10:32:04Z

commit aaaba1c86d04dac8e49bf508b492f81506257da3 upstream. There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below. It's better to add in rndis_add_response / rndis_free_response / rndis_get_next_response to prevent any race condition on response list. [ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0). [ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c Fixes: f6281af9d62e ("usb: gadget: rndis: use list_for_each_entry_safe") Cc: stable Signed-off-by: Daehwan Jung Link: https://lore.kernel.org/r/1645507768-77687-1-git-send-email-dh10.jung@samsung.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: rndis: check size of RNDIS_MSG_SET command

2022-02-16T11:43:54Z

commit 38ea1eac7d88072bbffb630e2b3db83ca649b826 upstream. Check the size of the RNDIS_MSG_SET command given to us before attempting to respond to an invalid message size. Reported-by: Szymon Heidrich Cc: stable@kernel.org Tested-by: Szymon Heidrich Signed-off-by: Greg Kroah-Hartman

usb: gadget: rndis: free response queue during REMOTE_NDIS_RESET_MSG

2016-08-11T12:09:48Z

When rndis data transfer is in progress, some Windows7 Host PC is not sending the GET_ENCAPSULATED_RESPONSE command for receiving the response for the previous SEND_ENCAPSULATED_COMMAND processed. The rndis function driver appends each response for the SEND_ENCAPSULATED_COMMAND in a queue. As the above process got corrupted, the Host sends a REMOTE_NDIS_RESET_MSG command to do a soft-reset. As the rndis response queue is not freed, the previous response is sent as a part of this REMOTE_NDIS_RESET_MSG's reset response and the Host block any more Rndis transfers. Hence free the rndis response queue as a part of this soft-reset so that the correct response for REMOTE_NDIS_RESET_MSG is sent properly during the response command. Signed-off-by: Rajkumar Raghupathy Signed-off-by: Xerox Lin [AmitP: Cherry-picked this patch and folded other relevant fixes from Android common kernel android-4.4] Signed-off-by: Amit Pundir Signed-off-by: Felipe Balbi

usb: gadget: rndis: fix itnull.cocci warnings

2016-02-03T21:36:04Z

The index variable of list_for_each_entry_safe is an offset from a list pointer, and thus should not be NULL. Generated by: scripts/coccinelle/iterators/itnull.cocci CC: Geliang Tang Signed-off-by: Fengguang Wu Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman

usb: gadget: rndis: use list_for_each_entry_safe

2016-01-25T04:55:33Z

Use list_for_each_entry_safe() instead of list_for_each_safe() to simplify the code. Signed-off-by: Geliang Tang Signed-off-by: Greg Kroah-Hartman

usb: gadget: rndis: use signed type for a signed value

2015-05-21T21:29:14Z

rndis_get_nr() returns either a non-negative value on success or a negative value on failure. In case of failure an error code is returned to the caller of rndis_register(). If the "i" is unsigned, the information about error from rndis_get_nr() is lost. If there is no error but rndis_get_nr() returns a value greater than 256 the least significant bits of i are zero effectively limiting the number of configs to 256. This patch fixes that. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

usb: gadget: rndis: don't duplicate the "i" variable

2015-05-21T21:29:05Z

If CONFIG_USB_GADGET_DEBUG_FILES is set then a block is opened and inside it there is a local variable "i" which hides the "i" local to the rndis_deregister(). Consequently, a random value is formatted into the "name" buffer. This patch removes the block-local i. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

usb: gadget: rndis: change the value passed to rndis_signal_(dis)connect()

2015-05-21T21:28:55Z

The patch: 83210e59ee1527f229af6aef78c95b747bdcf9c4 usb: gadget: rndis: use rndis_params instead of configNr should change all invocations of rndis_signal_(dis)connect(). This patch fixes that. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi

usb: gadget: rndis: remove the limit of available rndis connections

2015-05-07T18:47:17Z

RNDIS function has a limitation on the number of allowed instances. So far it has been RNDIS_MAX_CONFIGS, which happens to be one. In order to eliminate this kind of arbitrary limitation we should not preallocate a predefined (RNDIS_MAX_CONFIGS) array of struct rndis_params instances but instead allow allocating them on demand. This patch allocates struct rndis_params on demand in rndis_register(). Coversly, the structure is free()'d in rndis_deregister(). If CONFIG_USB_GADGET_DEBUG_FILES is set, the proc files are created which is the same behaviour as before, but the moment of creation is delayed until struct rndis_params is actually allocated. rnids_init() and rndis_exit() have nothing to do, so they are eliminated. Signed-off-by: Andrzej Pietrasiewicz Signed-off-by: Felipe Balbi