Skip to content

Commit a89a798

Browse files
gregkhgregkh
committed
Merge tag 'usb-serial-4.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Johan writes: USB-serial fixes for v4.5-rc2 Here are two fixes of crashes in the visor driver that could be triggered using bad (malicious) descriptors, a fix for two memory leaks in the new mxu11x0 driver, and an interface-blacklist fix for the option driver. Included are also some new device ids. Signed-off-by: Johan Hovold <johan@kernel.org>
2 parents d8f00cd + 4152b38 commit a89a798

File tree

6 files changed

+49
-3
lines changed

6 files changed

+49
-3
lines changed

‎drivers/usb/serial/cp210x.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ static const struct usb_device_id id_table[] = {
9999
{ USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
100100
{ USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
101101
{ USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
102+
{ USB_DEVICE(0x10C4, 0x81D7) }, /* IAI Corp. RCB-CV-USB USB to RS485 Adaptor */
102103
{ USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */
103104
{ USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */
104105
{ USB_DEVICE(0x10C4, 0x81E8) }, /* Zephyr Bioharness */

‎drivers/usb/serial/ftdi_sio.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -824,6 +824,7 @@ static const struct usb_device_id id_table_combined[] = {
824824
{ USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID),
825825
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
826826
{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
827+
{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
827828
{ USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
828829

829830
/* Papouch devices based on FTDI chip */

‎drivers/usb/serial/ftdi_sio_ids.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -615,6 +615,7 @@
615615
*/
616616
#define RATOC_VENDOR_ID 0x0584
617617
#define RATOC_PRODUCT_ID_USB60F 0xb020
618+
#define RATOC_PRODUCT_ID_SCU18 0xb03a
618619

619620
/*
620621
* Infineon Technologies

‎drivers/usb/serial/mxu11x0.c

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -368,6 +368,16 @@ static int mxu1_port_probe(struct usb_serial_port *port)
368368
return 0;
369369
}
370370

371+
static int mxu1_port_remove(struct usb_serial_port *port)
372+
{
373+
struct mxu1_port *mxport;
374+
375+
mxport = usb_get_serial_port_data(port);
376+
kfree(mxport);
377+
378+
return 0;
379+
}
380+
371381
static int mxu1_startup(struct usb_serial *serial)
372382
{
373383
struct mxu1_device *mxdev;
@@ -427,6 +437,14 @@ static int mxu1_startup(struct usb_serial *serial)
427437
return err;
428438
}
429439

440+
static void mxu1_release(struct usb_serial *serial)
441+
{
442+
struct mxu1_device *mxdev;
443+
444+
mxdev = usb_get_serial_data(serial);
445+
kfree(mxdev);
446+
}
447+
430448
static int mxu1_write_byte(struct usb_serial_port *port, u32 addr,
431449
u8 mask, u8 byte)
432450
{
@@ -957,7 +975,9 @@ static struct usb_serial_driver mxu11x0_device = {
957975
.id_table = mxu1_idtable,
958976
.num_ports = 1,
959977
.port_probe = mxu1_port_probe,
978+
.port_remove = mxu1_port_remove,
960979
.attach = mxu1_startup,
980+
.release = mxu1_release,
961981
.open = mxu1_open,
962982
.close = mxu1_close,
963983
.ioctl = mxu1_ioctl,

‎drivers/usb/serial/option.c

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,8 @@ static void option_instat_callback(struct urb *urb);
268268
#define TELIT_PRODUCT_CC864_SINGLE 0x1006
269269
#define TELIT_PRODUCT_DE910_DUAL 0x1010
270270
#define TELIT_PRODUCT_UE910_V2 0x1012
271+
#define TELIT_PRODUCT_LE922_USBCFG0 0x1042
272+
#define TELIT_PRODUCT_LE922_USBCFG3 0x1043
271273
#define TELIT_PRODUCT_LE920 0x1200
272274
#define TELIT_PRODUCT_LE910 0x1201
273275

@@ -615,6 +617,16 @@ static const struct option_blacklist_info telit_le920_blacklist = {
615617
.reserved = BIT(1) | BIT(5),
616618
};
617619

620+
static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
621+
.sendsetup = BIT(2),
622+
.reserved = BIT(0) | BIT(1) | BIT(3),
623+
};
624+
625+
static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = {
626+
.sendsetup = BIT(0),
627+
.reserved = BIT(1) | BIT(2) | BIT(3),
628+
};
629+
618630
static const struct usb_device_id option_ids[] = {
619631
{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
620632
{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -1160,6 +1172,10 @@ static const struct usb_device_id option_ids[] = {
11601172
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
11611173
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
11621174
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
1175+
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
1176+
.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
1177+
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3),
1178+
.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
11631179
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
11641180
.driver_info = (kernel_ulong_t)&telit_le910_blacklist },
11651181
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
@@ -1679,7 +1695,7 @@ static const struct usb_device_id option_ids[] = {
16791695
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
16801696
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
16811697
.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
1682-
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
1698+
{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) },
16831699
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
16841700
.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
16851701
{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },

‎drivers/usb/serial/visor.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial)
544544
(serial->num_interrupt_in == 0))
545545
return 0;
546546

547+
if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) {
548+
dev_err(&serial->interface->dev, "missing endpoints\n");
549+
return -ENODEV;
550+
}
551+
547552
/*
548553
* It appears that Treos and Kyoceras want to use the
549554
* 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,
@@ -597,8 +602,10 @@ static int clie_5_attach(struct usb_serial *serial)
597602
*/
598603

599604
/* some sanity check */
600-
if (serial->num_ports < 2)
601-
return -1;
605+
if (serial->num_bulk_out < 2) {
606+
dev_err(&serial->interface->dev, "missing bulk out endpoints\n");
607+
return -ENODEV;
608+
}
602609

603610
/* port 0 now uses the modified endpoint Address */
604611
port = serial->port[0];

0 commit comments

Comments
 (0)