patch "usb: fix various gadgets null ptr deref on 10gbps cabling." added to usb-linus
Subsystems (2)
This is a note to let you know that I've just added the patch titled
usb: fix various gadgets null ptr deref on 10gbps cabling.
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.
If you have any questions about this process, please let me know.
From 90c4d05780d47e14a50e11a7f17373104cd47d25 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <[email protected]>
Date: Mon, 7 Jun 2021 21:41:41 -0700
Subject: usb: fix various gadgets null ptr deref on 10gbps cabling.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This avoids a null pointer dereference in f_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm} by simply reusing the 5gbps config for 10gbps.
Fixes eaef50c76057 ("usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus")
Cc Christophe JAILLET <[email protected]>
Cc Felipe Balbi <[email protected]>
Cc Gustavo A. R. Silva <[email protected]>
Cc Lorenzo Colitti <[email protected]>
Cc Martin K. Petersen <[email protected]>
Cc Michael R Sweet <[email protected]>
Cc Mike Christie <[email protected]>
Cc Pawel Laszczak <[email protected]>
Cc Peter Chen <[email protected]>
Cc Sudhakar Panneerselvam <[email protected]>
Cc Wei Ming Chen <[email protected]>
Cc Will McVicker <[email protected]>
Cc Zqiang <[email protected]>
Reviewed-by Lorenzo Colitti <[email protected]>
Cc stable <[email protected]>
Signed-off-by Maciej Żenczykowski <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
--- drivers/usb/gadget/function/f_ecm.c | 2 +- drivers/usb/gadget/function/f_eem.c | 2 +- drivers/usb/gadget/function/f_hid.c | 3 ++- drivers/usb/gadget/function/f_loopback.c | 2 +- drivers/usb/gadget/function/f_printer.c | 3 ++- drivers/usb/gadget/function/f_rndis.c | 2 +- drivers/usb/gadget/function/f_serial.c | 2 +- drivers/usb/gadget/function/f_sourcesink.c | 3 ++- drivers/usb/gadget/function/f_subset.c | 2 +- drivers/usb/gadget/function/f_tcm.c | 3 ++- 10 files changed, 14 insertions(+), 10 deletions(-)
drivers/usb/gadget/function/f_ecm.c +1 -1
@@ -791,7 +791,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) fs_ecm_notify_desc.bEndpointAddress; status =usb_assign_descriptors (f, ecm_fs_function, ecm_hs_function, - ecm_ss_function,NULL ); + ecm_ss_function, ecm_ss_function);if (status) goto fail;
drivers/usb/gadget/function/f_eem.c +1 -1
@@ -302,7 +302,7 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f) eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress; status =usb_assign_descriptors (f, eem_fs_function, eem_hs_function, - eem_ss_function,NULL ); + eem_ss_function, eem_ss_function);if (status) goto fail;
drivers/usb/gadget/function/f_hid.c +2 -1
@@ -802,7 +802,8 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) hidg_fs_out_ep_desc.bEndpointAddress; status =usb_assign_descriptors (f, hidg_fs_descriptors, - hidg_hs_descriptors, hidg_ss_descriptors,NULL ); + hidg_hs_descriptors, hidg_ss_descriptors, + hidg_ss_descriptors);if (status) goto fail;
drivers/usb/gadget/function/f_loopback.c +1 -1
@@ -207,7 +207,7 @@ static int loopback_bind(struct usb_configuration *c, struct usb_function *f) ss_loop_sink_desc.bEndpointAddress = fs_loop_sink_desc.bEndpointAddress; ret =usb_assign_descriptors (f, fs_loopback_descs, hs_loopback_descs, - ss_loopback_descs,NULL ); + ss_loopback_descs, ss_loopback_descs);if (ret)return ret;
drivers/usb/gadget/function/f_printer.c +2 -1
@@ -1101,7 +1101,8 @@ static int printer_func_bind(struct usb_configuration *c, ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress; ret =usb_assign_descriptors (f, fs_printer_function, - hs_printer_function, ss_printer_function,NULL ); + hs_printer_function, ss_printer_function, + ss_printer_function);if (ret)return ret;
drivers/usb/gadget/function/f_rndis.c +1 -1
@@ -789,7 +789,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f) ss_notify_desc.bEndpointAddress = fs_notify_desc.bEndpointAddress; status =usb_assign_descriptors (f, eth_fs_function, eth_hs_function, - eth_ss_function,NULL ); + eth_ss_function, eth_ss_function);if (status) goto fail;
drivers/usb/gadget/function/f_serial.c +1 -1
@@ -233,7 +233,7 @@ static int gser_bind(struct usb_configuration *c, struct usb_function *f) gser_ss_out_desc.bEndpointAddress = gser_fs_out_desc.bEndpointAddress; status =usb_assign_descriptors (f, gser_fs_function, gser_hs_function, - gser_ss_function,NULL ); + gser_ss_function, gser_ss_function);if (status) goto fail; dev_dbg(&cdev->gadget->dev, "generic ttyGS%d: %s speed IN/%s OUT/%s\n",
drivers/usb/gadget/function/f_sourcesink.c +2 -1
@@ -431,7 +431,8 @@ sourcesink_bind(struct usb_configuration *c, struct usb_function *f) ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress; ret =usb_assign_descriptors (f, fs_source_sink_descs, - hs_source_sink_descs, ss_source_sink_descs,NULL ); + hs_source_sink_descs, ss_source_sink_descs, + ss_source_sink_descs);if (ret)return ret;
drivers/usb/gadget/function/f_subset.c +1 -1
@@ -358,7 +358,7 @@ geth_bind(struct usb_configuration *c, struct usb_function *f) fs_subset_out_desc.bEndpointAddress; status =usb_assign_descriptors (f, fs_eth_function, hs_eth_function, - ss_eth_function,NULL ); + ss_eth_function, ss_eth_function);if (status) goto fail;
drivers/usb/gadget/function/f_tcm.c +2 -1
@@ -2057,7 +2057,8 @@ static int tcm_bind(struct usb_configuration *c, struct usb_function *f) uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress; ret =usb_assign_descriptors (f, uasp_fs_function_desc, - uasp_hs_function_desc, uasp_ss_function_desc,NULL ); + uasp_hs_function_desc, uasp_ss_function_desc, + uasp_ss_function_desc);if (ret) goto ep_fail;
Signature · 1 line
2.32.0