Patch "USB: hub: fix SS hub-descriptor handling" has been added to the 3.18-stable tree

This is a note to let you know that I've just added the patch titled

USB: hub: fix SS hub-descriptor handling

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
usb-hub-fix-ss-hub-descriptor-handling.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Johan Hovold <[email protected]>
Date: Wed, 10 May 2017 18:18:27 +0200
Subject: USB: hub: fix SS hub-descriptor handling

From: Johan Hovold <[email protected]>

commit 2c25a2c818023df64463aac3288a9f969491e507 upstream.

A SuperSpeed hub descriptor does not have any variable-length fields so bail out when reading a short descriptor.

This avoids parsing and leaking two bytes of uninitialised slab data through sysfs removable-attributes.

---
 drivers/usb/core/hub.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -377,8 +377,12 @@ static int get_hub_descriptor(struct usb
 			USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
 			dtype << 8, 0, data, size,
 			USB_CTRL_GET_TIMEOUT);
-		if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2))
+		if (hub_is_superspeed(hdev)) {
+			if (ret == size)
+				return ret;
+		} else if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2)) {
 			return ret;
+		}
 	}
 	return -EINVAL;
 }

@@ -1331,7 +1335,7 @@ static int hub_configure(struct usb_hub
 
 	/* Request the entire hub descriptor.
 	 * hub->descriptor can handle USB_MAXCHILDREN ports,
-	 * but the hub can/will return fewer bytes here.
+	 * but a (non-SS) hub can/will return fewer bytes here.
 	 */
 	ret = get_hub_descriptor(hdev, hub->descriptor);
 	if (ret < 0) {

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch queue-3.18/usb-serial-option-add-telit-me910-support.patch queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch queue-3.18/of-fdt-add-missing-allocation-failure-check.patch queue-3.18/usbvision-fix-null-deref-at-probe.patch queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch queue-3.18/mceusb-fix-null-deref-at-probe.patch queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch