This is a note to let you know that I've just added the patch titled
USB: hub: fix SS hub-descriptor handling
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-hub-fix-ss-hub-descriptor-handling.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 2c25a2c818023df64463aac3288a9f969491e507 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@xxxxxxxxxx>
Date: Wed, 10 May 2017 18:18:27 +0200
Subject: USB: hub: fix SS hub-descriptor handling
From: Johan Hovold <johan@xxxxxxxxxx>
commit 2c25a2c818023df64463aac3288a9f969491e507 upstream.
A SuperSpeed hub descriptor does not have any variable-length fields so
bail out when reading a short descriptor.
This avoids parsing and leaking two bytes of uninitialised slab data
through sysfs removable-attributes.
Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes")
Cc: John Youn <John.Youn@xxxxxxxxxxxx>
Acked-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/usb/core/hub.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -380,8 +380,12 @@ static int get_hub_descriptor(struct usb
USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
dtype << 8, 0, data, size,
USB_CTRL_GET_TIMEOUT);
- if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2))
+ if (hub_is_superspeed(hdev)) {
+ if (ret == size)
+ return ret;
+ } else if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2)) {
return ret;
+ }
}
return -EINVAL;
}
@@ -1321,7 +1325,7 @@ static int hub_configure(struct usb_hub
/* Request the entire hub descriptor.
* hub->descriptor can handle USB_MAXCHILDREN ports,
- * but the hub can/will return fewer bytes here.
+ * but a (non-SS) hub can/will return fewer bytes here.
*/
ret = get_hub_descriptor(hdev, hub->descriptor);
if (ret < 0) {
Patches currently in stable-queue which might be from johan@xxxxxxxxxx are
queue-4.11/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-4.11/usb-chaoskey-fix-alea-quirk-on-big-endian-hosts.patch
queue-4.11/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-4.11/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-4.11/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-4.11/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-4.11/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-4.11/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-4.11/usb-serial-option-add-telit-me910-support.patch
queue-4.11/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-4.11/of-fdt-add-missing-allocation-failure-check.patch
queue-4.11/usbvision-fix-null-deref-at-probe.patch
queue-4.11/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-4.11/usb-ehci-platform-fix-companion-device-leak.patch
queue-4.11/mceusb-fix-null-deref-at-probe.patch
queue-4.11/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-4.11/ath9k_htc-fix-null-deref-at-probe.patch
queue-4.11/usb-musb-fix-trying-to-suspend-while-active-for-otg-configurations.patch