lkml.org 
[lkml]   [2017]   [May]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.10 078/129] USB: serial: io_edgeport: fix epic-descriptor handling
    Date
    4.10-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <johan@kernel.org>

    commit e4457d9798adb96272468e93da663de9bd0a4198 upstream.

    Use a dedicated buffer for the DMA transfer and make sure to detect
    short transfers to avoid parsing a corrupt descriptor.

    Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver")
    Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/serial/io_edgeport.c | 24 ++++++++++++++++++------
    1 file changed, 18 insertions(+), 6 deletions(-)

    --- a/drivers/usb/serial/io_edgeport.c
    +++ b/drivers/usb/serial/io_edgeport.c
    @@ -492,20 +492,24 @@ static int get_epic_descriptor(struct ed
    int result;
    struct usb_serial *serial = ep->serial;
    struct edgeport_product_info *product_info = &ep->product_info;
    - struct edge_compatibility_descriptor *epic = &ep->epic_descriptor;
    + struct edge_compatibility_descriptor *epic;
    struct edge_compatibility_bits *bits;
    struct device *dev = &serial->dev->dev;

    ep->is_epic = 0;
    +
    + epic = kmalloc(sizeof(*epic), GFP_KERNEL);
    + if (!epic)
    + return -ENOMEM;
    +
    result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
    USB_REQUEST_ION_GET_EPIC_DESC,
    0xC0, 0x00, 0x00,
    - &ep->epic_descriptor,
    - sizeof(struct edge_compatibility_descriptor),
    + epic, sizeof(*epic),
    300);
    -
    - if (result > 0) {
    + if (result == sizeof(*epic)) {
    ep->is_epic = 1;
    + memcpy(&ep->epic_descriptor, epic, sizeof(*epic));
    memset(product_info, 0, sizeof(struct edgeport_product_info));

    product_info->NumPorts = epic->NumPorts;
    @@ -534,8 +538,16 @@ static int get_epic_descriptor(struct ed
    dev_dbg(dev, " IOSPWriteLCR : %s\n", bits->IOSPWriteLCR ? "TRUE": "FALSE");
    dev_dbg(dev, " IOSPSetBaudRate : %s\n", bits->IOSPSetBaudRate ? "TRUE": "FALSE");
    dev_dbg(dev, " TrueEdgeport : %s\n", bits->TrueEdgeport ? "TRUE": "FALSE");
    +
    + result = 0;
    + } else if (result >= 0) {
    + dev_warn(&serial->interface->dev, "short epic descriptor received: %d\n",
    + result);
    + result = -EIO;
    }

    + kfree(epic);
    +
    return result;
    }

    @@ -2779,7 +2791,7 @@ static int edge_startup(struct usb_seria
    dev_info(&serial->dev->dev, "%s detected\n", edge_serial->name);

    /* Read the epic descriptor */
    - if (get_epic_descriptor(edge_serial) <= 0) {
    + if (get_epic_descriptor(edge_serial) < 0) {
    /* memcpy descriptor to Supports structures */
    memcpy(&edge_serial->epic_descriptor.Supports, descriptor,
    sizeof(struct edge_compatibility_bits));

    \
     
     \ /
      Last update: 2017-05-11 17:23    [W:4.702 / U:0.248 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site