There used to be an integer overflow check in proc_do_submiturb() but
it accidentally got removed. We need to put it back. The
uurb->buffer_length variable is a signed integer and it's controlled by
the user. It can lead to an integer overflow when we do:
num_sgs = DIV_ROUND_UP(uurb->bu
On Wed, Sep 20, 2017 at 04:45:08PM +0200, Andrey Konovalov wrote:
> Hi!
>
> I've got the following crash while fuzzing the kernel with syzkaller.
>
> On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
>
> It looks like cdc_parse_cdc_header() doesn't validate buflen before
> accessing b
Hi Greg,
here's my first set of fixes for the current -rc cycle. Things are
rather calm, surprisingly.
Let me know if you want anything to be changed.
cheers
The following changes since commit 2bd6bf03f4c1c59381d62c61d03f6cc3fe71f66e:
Linux 4.14-rc1 (2017-09-16 15:47:51 -0700)
are availabl
On 21.09.2017 07:13, Mustafa Mehmed wrote:
Hello USB devs,
I have a JMicron HDD dock using an USB3.0 interface. It mounts OK
initially then after a while (random times) writing/reading fails and
the HDD is unmounted.
I use this for doing backups and am having interminable problems.
The follow
On Thu, Sep 21, 2017 at 09:31:54AM +0200, Greg Kroah-Hartman wrote:
> On Wed, Sep 20, 2017 at 04:45:08PM +0200, Andrey Konovalov wrote:
> > Hi!
> >
> > I've got the following crash while fuzzing the kernel with syzkaller.
> >
> > On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
> >
>
On Thu, Sep 21, 2017 at 10:43:41AM +0300, Felipe Balbi wrote:
>
> Hi Greg,
>
> here's my first set of fixes for the current -rc cycle. Things are
> rather calm, surprisingly.
>
> Let me know if you want anything to be changed.
>
> cheers
>
> The following changes since commit 2bd6bf03f4c1c5938
On Sat, Sep 16, 2017 at 01:42:20PM +0300, Serge Semin wrote:
> diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
> index 71994b883..c2dd9742f 100644
> --- a/drivers/usb/misc/usb251xb.c
> +++ b/drivers/usb/misc/usb251xb.c
> @@ -3,6 +3,7 @@
> * Configuration via SMBus.
> *
>
2017-09-18 12:00 GMT+02:00 Boris Brezillon :
> Hi Romain,
>
> On Fri, 15 Sep 2017 16:04:07 +0200
> Romain Izard wrote:
>
>> It is not normal for the PMECC to fail when trying to fix ECC errors.
>> Report these cases as errors.
>
> I'm not sure we want to have ECC error messages at this level. ECC
This is used to force PHY with USB OTG function to enter a specific
mode, and override OTG IDPIN(or IDDIG) signal.
Signed-off-by: Chunfeng Yun
---
drivers/phy/mediatek/phy-mtk-tphy.c | 39 +++
1 file changed, 39 insertions(+)
diff --git a/drivers/phy/mediatek/p
Chip bank of version-1 is initialized as NULL, but it's used
by pcie_phy_instance_power_on/off(), so assign it a right
address.
Signed-off-by: Chunfeng Yun
---
drivers/phy/mediatek/phy-mtk-tphy.c |3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/phy/mediatek/phy-mt
Hello Alan.
> Plenty of things could affect it. Without knowing more about your system, I
> can't be more specific. For example, what UDC
> driver are you using?
Ah 😊. It's an ancient (3.4.x*) sunxi_usb_hdc running on an AllWinner H3.
> And have you tried testing your program with the dummy-
On Thursday 21 September 2017 04:01 PM, Chunfeng Yun wrote:
> Chip bank of version-1 is initialized as NULL, but it's used
> by pcie_phy_instance_power_on/off(), so assign it a right
> address.
merged. How was this not noticed before?
Thanks
Kishon
>
> Signed-off-by: Chunfeng Yun
> ---
> dri
Hi,
On Monday 18 September 2017 07:50 PM, Andrzej Pietrasiewicz wrote:
> Hi,
>
> W dniu 18.09.2017 o 14:43, Felipe Balbi pisze:
>>
>> Hi,
>>
>> Andrzej Pietrasiewicz writes:
>>> +static int exynos5_usbdrd_phy_reset(struct phy *phy)
>>> +{
>>> +struct phy_usb_instance *inst = phy_
Hi,
On 19-09-17 14:40, Mathias Nyman wrote:
Hi,
sorry about the long delay
On 07.09.2017 18:49, Hans de Goede wrote:
Hi,
On 07-09-17 15:14, Mathias Nyman wrote:
On 05.09.2017 19:42, Hans de Goede wrote:
The Intel cherrytrail xhci controller has an extended cap mmio-range
which contains reg
Hi,
On 10-09-17 23:36, Peter Rosin wrote:
On 2017-09-08 19:07, Hans de Goede wrote:
Hi,
On 08-09-17 17:47, Peter Rosin wrote:
On 2017-09-05 18:42, Hans de Goede wrote:
Add MUX_USB_* and MUX_TYPEC_* state constant defines, which can be used by
USB device/host, resp. Type-C polarity/role/altmo
Use setup_timer function instead of initializing timer with the
function and data fields.
Signed-off-by: Allen Pais
---
drivers/net/usb/catc.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
index dbc9031..aeb62e1 100
On Thu, Sep 21, 2017 at 10:04 AM, Greg Kroah-Hartman
wrote:
> On Thu, Sep 21, 2017 at 09:31:54AM +0200, Greg Kroah-Hartman wrote:
>> On Wed, Sep 20, 2017 at 04:45:08PM +0200, Andrey Konovalov wrote:
>> > Hi!
>> >
>> > I've got the following crash while fuzzing the kernel with syzkaller.
>> >
>> >
On Wed, Sep 20 2017, Kees Cook wrote:
> If the probe fails, udc_remove() will not be called, so there is no
> reason to make del_timer_sync() calls conditional. As a result, use of
> the .data field can be dropped, in support of making removing this field
> entirely from struct timer_list.
>
> Cc:
On Thu, Sep 21, 2017 at 03:51:44PM +0200, Andrey Konovalov wrote:
> On Thu, Sep 21, 2017 at 10:04 AM, Greg Kroah-Hartman
> wrote:
> > On Thu, Sep 21, 2017 at 09:31:54AM +0200, Greg Kroah-Hartman wrote:
> >> On Wed, Sep 20, 2017 at 04:45:08PM +0200, Andrey Konovalov wrote:
> >> > Hi!
> >> >
> >> >
On Thu, Sep 21, 2017 at 4:07 PM, Greg Kroah-Hartman
wrote:
> On Thu, Sep 21, 2017 at 03:51:44PM +0200, Andrey Konovalov wrote:
>> On Thu, Sep 21, 2017 at 10:04 AM, Greg Kroah-Hartman
>> wrote:
>> > On Thu, Sep 21, 2017 at 09:31:54AM +0200, Greg Kroah-Hartman wrote:
>> >> On Wed, Sep 20, 2017 at 0
On Thu, 21 Sep 2017, Dan Carpenter wrote:
> There used to be an integer overflow check in proc_do_submiturb() but
> it accidentally got removed. We need to put it back. The
The removal was deliberate, not accidental. :-)
> uurb->buffer_length variable is a signed integer and it's controlled b
On Thu, Sep 21, 2017 at 10:17:03AM -0400, Alan Stern wrote:
> On Thu, 21 Sep 2017, Dan Carpenter wrote:
>
> > There used to be an integer overflow check in proc_do_submiturb() but
> > it accidentally got removed. We need to put it back. The
>
> The removal was deliberate, not accidental. :-)
>
On Thu, 21 Sep 2017, Dan Carpenter wrote:
> On Thu, Sep 21, 2017 at 10:17:03AM -0400, Alan Stern wrote:
> > On Thu, 21 Sep 2017, Dan Carpenter wrote:
> >
> > > There used to be an integer overflow check in proc_do_submiturb() but
> > > it accidentally got removed. We need to put it back. The
>
On Thu, Sep 21, 2017 at 10:23:38AM +0200, Greg KH
wrote:
> On Sat, Sep 16, 2017 at 01:42:20PM +0300, Serge Semin wrote:
> > diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
> > index 71994b883..c2dd9742f 100644
> > --- a/drivers/usb/misc/usb251xb.c
> > +++ b/drivers/usb/misc
On Thu, Sep 21, 2017 at 10:17:03AM -0400, Alan Stern wrote:
> On Thu, 21 Sep 2017, Dan Carpenter wrote:
>
> > There used to be an integer overflow check in proc_do_submiturb() but
> > it accidentally got removed. We need to put it back. The
>
> The removal was deliberate, not accidental. :-)
>
On Thu, Sep 21, 2017 at 05:51:29PM +0300, Serge Semin wrote:
> On Thu, Sep 21, 2017 at 10:23:38AM +0200, Greg KH
> wrote:
> > On Sat, Sep 16, 2017 at 01:42:20PM +0300, Serge Semin wrote:
> > > diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
> > > index 71994b883..c2dd9742f
On Wed, 20 Sep 2017, Kris Lindgren wrote:
> On Wed, Sep 20, 2017 at 3:00 PM, Alan Stern wrote:
> > On Wed, 20 Sep 2017, Kris Lindgren wrote:
> >
> >> Hi Alan,
> >>
> >> Sorry for the delay. This did indeed solve the problem. I rebuilt
> >> the kernel with that patch applied and without any spec
On Thu, 21 Sep 2017, Dan Carpenter wrote:
> On Thu, Sep 21, 2017 at 10:17:03AM -0400, Alan Stern wrote:
> > On Thu, 21 Sep 2017, Dan Carpenter wrote:
> >
> > > There used to be an integer overflow check in proc_do_submiturb() but
> > > it accidentally got removed. We need to put it back. The
>
Hi!
I've got the following report while fuzzing the kernel with syzkaller.
On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
Looks like hso_create_net_device() can do goto exit before registering
network device.
hso 1-1:4.0: Can't find BULK IN endpoint
[ cut here ]---
Hi!
I've got the following report while fuzzing the kernel with syzkaller.
On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
Is seems there's no check on the if_num value when it's used in ((u32
*)(id->driver_info))[if_num].
===
Hi!
I've got the following report while fuzzing the kernel with syzkaller.
On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
The issue occurs when we iterate over interface altsettings, but I
don't see the driver doing anything wrong. I might be missing
something, or this might be an
On Thu, Sep 21, 2017 at 05:39:05PM +0200, Andrey Konovalov wrote:
> Hi!
>
> I've got the following report while fuzzing the kernel with syzkaller.
>
> On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
>
> The issue occurs when we iterate over interface altsettings, but I
> don't see t
On Wed, Sep 20, 2017 at 4:27 PM, Serge Semin wrote:
> On Wed, Sep 20, 2017 at 03:52:55PM -0500, Rob Herring wrote:
>> On Sat, Sep 16, 2017 at 01:42:19PM +0300, Serge Semin wrote:
>> > This parameters may be varied in accordance with hardware specifics.
>> > So lets add the corresponding settings
Hi!
I've got the following report while fuzzing the kernel with syzkaller.
On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
Line numbers might be a little off, due to some local changes to
gadgetfs code but the issue is AFAIU with calling copy_to_user() with
spinlock held in ep0_read
On Thu, 21 Sep 2017, Andrey Konovalov wrote:
> Hi!
>
> I've got the following report while fuzzing the kernel with syzkaller.
>
> On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
>
> The issue occurs when we iterate over interface altsettings, but I
> don't see the driver doing anyt
On Wed, Sep 20, 2017 at 4:15 PM, Serge Semin wrote:
> On Wed, Sep 20, 2017 at 03:52:35PM -0500, Rob Herring wrote:
>> On Sat, Sep 16, 2017 at 02:31:09AM +0300, Serge Semin wrote:
>> > USB2517i hubs are very like USB251xb devices series. They have almost
>> > the same configuration registers space
On Thu, Sep 21, 2017 at 6:50 PM, Alan Stern wrote:
> On Thu, 21 Sep 2017, Andrey Konovalov wrote:
>
>> Hi!
>>
>> I've got the following report while fuzzing the kernel with syzkaller.
>>
>> On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
>>
>> The issue occurs when we iterate over int
As a holdover from the old g_file_storage gadget, the g_mass_storage
legacy gadget driver attempts to unregister itself when its main
operating thread terminates (if it hasn't been unregistered already).
This is not strictly necessary; it was never more than an attempt to
have the gadget fail clean
On Thu, Sep 21, 2017 at 11:26:04AM -0500, Rob Herring wrote:
> On Wed, Sep 20, 2017 at 4:27 PM, Serge Semin wrote:
> > On Wed, Sep 20, 2017 at 03:52:55PM -0500, Rob Herring
> > wrote:
> >> On Sat, Sep 16, 2017 at 01:42:19PM +0300, Serge Semin wrote:
> >> > This parameters may be varied in accor
The gadgetfs driver (drivers/usb/gadget/legacy/inode.c) was written
before the UDC and composite frameworks were adopted; it is a legacy
driver. As such, it expects that once bound to a UDC controller, it
will not be unbound until it unregisters itself.
However, the UDC framework does unbind func
On Thu, 21 Sep 2017, Andrey Konovalov wrote:
> Hi!
>
> I've got the following report while fuzzing the kernel with syzkaller.
>
> On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
>
> Line numbers might be a little off, due to some local changes to
> gadgetfs code but the issue is AF
On Thu, Sep 21, 2017 at 11:53:29AM -0500, Rob Herring wrote:
> On Wed, Sep 20, 2017 at 4:15 PM, Serge Semin wrote:
> > On Wed, Sep 20, 2017 at 03:52:35PM -0500, Rob Herring
> > wrote:
> >> On Sat, Sep 16, 2017 at 02:31:09AM +0300, Serge Semin wrote:
> >> > USB2517i hubs are very like USB251xb d
On Thu, Sep 21, 2017 at 9:25 AM, Alan Stern wrote:
> On Wed, 20 Sep 2017, Kris Lindgren wrote:
>
>> On Wed, Sep 20, 2017 at 3:00 PM, Alan Stern
>> wrote:
>> > On Wed, 20 Sep 2017, Kris Lindgren wrote:
>> >
>> >> Hi Alan,
>> >>
>> >> Sorry for the delay. This did indeed solve the problem. I reb
On Thu, Sep 21, 2017 at 7:35 PM, Alan Stern wrote:
> On Thu, 21 Sep 2017, Andrey Konovalov wrote:
>
>> Hi!
>>
>> I've got the following report while fuzzing the kernel with syzkaller.
>>
>> On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
>>
>> Line numbers might be a little off, due t
On Thu, 21 Sep 2017, Andrey Konovalov wrote:
> On Thu, Sep 21, 2017 at 6:10 PM, Greg Kroah-Hartman
> wrote:
> > On Thu, Sep 21, 2017 at 05:39:05PM +0200, Andrey Konovalov wrote:
> >> Hi!
> >>
> >> I've got the following report while fuzzing the kernel with syzkaller.
> >>
> >> On commit ebb2c2437
On Thu, 21 Sep 2017, Kris Lindgren wrote:
> >> > Those Hardware Error messages are annoying, aren't they? Other people
> >> > have complained about them in the past. Would you mind testing a patch
> >> > that should eliminate them?
> >> >
> >> > Alan Stern
> >>
> >> Yes, I can test another patch
Kris Lindgren reports that without the NO_WP_DETECT flag, his Seagate
external disk drive fails all write accesses. This regresssion dates
back approximately to the start of the 4.x kernel releases.
Signed-off-by: Alan Stern
Reported-by: Kris Lindgren
CC:
---
[as1842]
drivers/usb/storage
Ever since commit a621bac3044e ("scsi_lib: correctly retry failed zero
length REQ_TYPE_FS commands"), people have been getting bogus error
messages for USB disk drives using ATA pass-thru. For example:
[ 1344.880193] sd 6:0:0:0: [sdb] Attached SCSI disk
[ 1345.069152] sd 6:0:0:0: [sdb] tag#0 FAIL
The gadgetfs driver as a long-outstanding FIXME, regarding a call of
copy_to_user() made while holding a spinlock. This patch fixes the
issue by dropping the spinlock and using the dev->udc_usage mechanism
introduced by another recent patch to guard against status changes
while the lock isn't held
Hello!
On 09/21/2017 11:12 PM, Alan Stern wrote:
The gadgetfs driver as a long-outstanding FIXME, regarding a call of
s/as/has/?
copy_to_user() made while holding a spinlock. This patch fixes the
issue by dropping the spinlock and using the dev->udc_usage mechanism
introduced by another
On Thu, Sep 21 2017, Alan Stern wrote:
> As a holdover from the old g_file_storage gadget, the g_mass_storage
> legacy gadget driver attempts to unregister itself when its main
> operating thread terminates (if it hasn't been unregistered already).
> This is not strictly necessary; it was never mor
From: Allen Pais
Date: Thu, 21 Sep 2017 18:24:15 +0530
> Use setup_timer function instead of initializing timer with the
> function and data fields.
>
> Signed-off-by: Allen Pais
Applied.
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message t
On Thu, 2017-09-21 at 16:23 +0530, Kishon Vijay Abraham I wrote:
>
> On Thursday 21 September 2017 04:01 PM, Chunfeng Yun wrote:
> > Chip bank of version-1 is initialized as NULL, but it's used
> > by pcie_phy_instance_power_on/off(), so assign it a right
> > address.
>
> merged. How was this not
53 matches
Mail list logo
