From 7a9a65ced11ece416b730d6f21040a18e62d78a8 Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Tue, 14 Apr 2009 14:57:36 +0100 Subject: cdc-acm: Fix long standing abuse of tty->low_latency ACM sets the low latency flag but calls the flip buffer routines from IRQ context which isn't permitted (and as of 2.6.29 causes a warning hence this one was caught) Fortunatelt ACM doesn't need to set this flag in the first place as it only set it to work around problems in ancient (pre tty flip rewrite) kernels. Reported-by: Chuck Ebbert Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds --- drivers/usb/class/cdc-acm.c | 4 ---- 1 file changed, 4 deletions(-) (limited to 'drivers/usb/class') diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 869d47cb6db3..0a69c0977e3f 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -546,10 +546,6 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp) tty->driver_data = acm; acm->tty = tty; - /* force low_latency on so that our tty_push actually forces the data through, - otherwise it is scheduled, and with high data rates data can get lost. */ - tty->low_latency = 1; - if (usb_autopm_get_interface(acm->control) < 0) goto early_bail; else -- cgit v1.2.3 From e13c594f3a1fc2c78e7a20d1a07974f71e4b448f Mon Sep 17 00:00:00 2001 From: Oliver Neukum Date: Sat, 4 Apr 2009 09:25:15 +0200 Subject: USB: fix oops in cdc-wdm in case of malformed descriptors cdc-wdm needs to ignore extremely malformed descriptors. Signed-off-by: Oliver Neukum Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/usb/class/cdc-wdm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/usb/class') diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c index 3771d6e6d0cc..34e6108e1d42 100644 --- a/drivers/usb/class/cdc-wdm.c +++ b/drivers/usb/class/cdc-wdm.c @@ -652,7 +652,7 @@ next_desc: iface = &intf->altsetting[0]; ep = &iface->endpoint[0].desc; - if (!usb_endpoint_is_int_in(ep)) { + if (!ep || !usb_endpoint_is_int_in(ep)) { rv = -EINVAL; goto err; } -- cgit v1.2.3 From 052fbc0d7f76106725c998183d64dcacecd21f8f Mon Sep 17 00:00:00 2001 From: Oliver Neukum Date: Mon, 20 Apr 2009 17:24:49 +0200 Subject: USB: correct error handling in cdc-wdm This patch to cdc-wdm - checks for partial extra descriptors - fixes a leak in the error case of probe - checks for an exact number of endpoints - adds a clarifying comment Signed-off-by: Oliver Neukum Cc: David Brownell Signed-off-by: Greg Kroah-Hartman --- drivers/usb/class/cdc-wdm.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) (limited to 'drivers/usb/class') diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c index 34e6108e1d42..0fe434505ac4 100644 --- a/drivers/usb/class/cdc-wdm.c +++ b/drivers/usb/class/cdc-wdm.c @@ -3,7 +3,7 @@ * * This driver supports USB CDC WCM Device Management. * - * Copyright (c) 2007-2008 Oliver Neukum + * Copyright (c) 2007-2009 Oliver Neukum * * Some code taken from cdc-acm.c * @@ -610,7 +610,7 @@ static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id) if (!buffer) goto out; - while (buflen > 0) { + while (buflen > 2) { if (buffer [1] != USB_DT_CS_INTERFACE) { dev_err(&intf->dev, "skipping garbage\n"); goto next_desc; @@ -646,16 +646,18 @@ next_desc: spin_lock_init(&desc->iuspin); init_waitqueue_head(&desc->wait); desc->wMaxCommand = maxcom; + /* this will be expanded and needed in hardware endianness */ desc->inum = cpu_to_le16((u16)intf->cur_altsetting->desc.bInterfaceNumber); desc->intf = intf; INIT_WORK(&desc->rxwork, wdm_rxwork); - iface = &intf->altsetting[0]; + rv = -EINVAL; + iface = intf->cur_altsetting; + if (iface->desc.bNumEndpoints != 1) + goto err; ep = &iface->endpoint[0].desc; - if (!ep || !usb_endpoint_is_int_in(ep)) { - rv = -EINVAL; + if (!ep || !usb_endpoint_is_int_in(ep)) goto err; - } desc->wMaxPacketSize = le16_to_cpu(ep->wMaxPacketSize); desc->bMaxPacketSize0 = udev->descriptor.bMaxPacketSize0; @@ -711,12 +713,19 @@ next_desc: usb_set_intfdata(intf, desc); rv = usb_register_dev(intf, &wdm_class); - dev_info(&intf->dev, "cdc-wdm%d: USB WDM device\n", - intf->minor - WDM_MINOR_BASE); if (rv < 0) - goto err; + goto err3; + else + dev_info(&intf->dev, "cdc-wdm%d: USB WDM device\n", + intf->minor - WDM_MINOR_BASE); out: return rv; +err3: + usb_set_intfdata(intf, NULL); + usb_buffer_free(interface_to_usbdev(desc->intf), + desc->bMaxPacketSize0, + desc->inbuf, + desc->response->transfer_dma); err2: usb_buffer_free(interface_to_usbdev(desc->intf), desc->wMaxPacketSize, -- cgit v1.2.3