-From akpm@linux-foundation.org Fri Jun 6 14:27:29 2008

-From: akpm@linux-foundation.org

-Date: Fri, 06 Jun 2008 12:35:15 -0700

-To: mm-commits@vger.kernel.org

-Cc: mjg59@srcf.ucam.org, greg@kroah.com, justinmattock@gmail.com, mjg@redhat.com

-Subject: isight_firmware: Avoid crash on loading invalid firmware

-Message-ID: <200806061935.m56JZFDr015264@imap1.linux-foundation.org>

-

-From: Matthew Garrett <mjg59@srcf.ucam.org>

-

-Different tools generate slightly different formats of the isight

-firmware. Ensure that the firmware buffer is not overrun, while still

-ensuring that the correct amount of data is written if trailing data is

-present.

-

-Signed-off-by: Matthew Garrett <mjg@redhat.com>

-Report-by: Justin Mattock <justinmattock@gmail.com>

-Tested-by: Justin Mattock <justinmattock@gmail.com>

-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/usb/misc/isight_firmware.c | 23 ++++++++++++++++-------

- 1 file changed, 16 insertions(+), 7 deletions(-)

-

---- a/drivers/usb/misc/isight_firmware.c

-+++ b/drivers/usb/misc/isight_firmware.c

-@@ -39,9 +39,12 @@ static int isight_firmware_load(struct u

- struct usb_device *dev = interface_to_usbdev(intf);

- int llen, len, req, ret = 0;

- const struct firmware *firmware;

-- unsigned char *buf;

-+ unsigned char *buf = kmalloc(50, GFP_KERNEL);

- unsigned char data[4];

-- char *ptr;

-+ u8 *ptr;

-+

-+ if (!buf)

-+ return -ENOMEM;

-

- if (request_firmware(&firmware, "isight.fw", &dev->dev) != 0) {

- printk(KERN_ERR "Unable to load isight firmware\n");

-@@ -59,7 +62,7 @@ static int isight_firmware_load(struct u

- goto out;

- }

-

-- while (1) {

-+ while (ptr+4 <= firmware->data+firmware->size) {

- memcpy(data, ptr, 4);

- len = (data[0] << 8 | data[1]);

- req = (data[2] << 8 | data[3]);

-@@ -71,10 +74,14 @@ static int isight_firmware_load(struct u

- continue;

-

- for (; len > 0; req += 50) {

-- llen = len > 50 ? 50 : len;

-+ llen = min(len, 50);

- len -= llen;

--

-- buf = kmalloc(llen, GFP_KERNEL);

-+ if (ptr+llen > firmware->data+firmware->size) {

-+ printk(KERN_ERR

-+ "Malformed isight firmware");

-+ ret = -ENODEV;

-+ goto out;

-+ }

- memcpy(buf, ptr, llen);

-

- ptr += llen;

-@@ -89,16 +96,18 @@ static int isight_firmware_load(struct u

- goto out;

- }

-

-- kfree(buf);

- }

- }

-+

- if (usb_control_msg

- (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,

- 300) != 1) {

- printk(KERN_ERR "isight firmware loading completion failed\n");

- ret = -ENODEV;

- }

-+

- out:

-+ kfree(buf);

- release_firmware(firmware);

- return ret;

- }

-From stern@rowland.harvard.edu Tue Jun 10 14:31:37 2008

-From: Linus Torvalds <torvalds@linux-foundation.org>

-Date: Tue, 10 Jun 2008 14:59:43 -0400 (EDT)

-Subject: USB: don't use reset-resume if drivers don't support it

-To: Greg KH <greg@kroah.com>

-Cc: Linus Torvalds <torvalds@linux-foundation.org>, Oliver Neukum <oliver@neukum.org>, Pavel Machek <pavel@suse.cz>, USB list <linux-usb@vger.kernel.org>, Andrew Morton <akpm@linuxfoundation.org>, kernel list <linux-kernel@vger.kernel.org>, "Rafael J. Wysocki" <rjw@sisk.pl>

-Message-ID: <Pine.LNX.4.44L0.0806101454480.3658-100000@iolanthe.rowland.org>

-

-From: Linus Torvalds <torvalds@linux-foundation.org>

-

-This patch tries to identify which devices are able to accept

-reset-resume handling, by checking that there is at least one

-interface driver bound and that all of the drivers have a reset_resume

-method defined. If these conditions don't hold then during resume

-processing, the device is logicall disconnected.

-

-This is only a temporary fix. Later on we will explicitly unbind

-drivers that can't handle reset-resumes.

-

-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

-Signed-off-by: Alan Stern <stern@rowland.harvard.edu>

-Cc: Oliver Neukum <oliver@neukum.org>

-Cc: Pavel Machek <pavel@suse.cz>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/usb/core/hub.c | 46 ++++++++++++++++++++++++++++++++++++++++++++--

- 1 file changed, 44 insertions(+), 2 deletions(-)

-

---- a/drivers/usb/core/hub.c

-+++ b/drivers/usb/core/hub.c

-@@ -644,6 +644,48 @@ static void hub_stop(struct usb_hub *hub

-

- #ifdef CONFIG_PM

-

-+/* Try to identify which devices need USB-PERSIST handling */

-+static int persistent_device(struct usb_device *udev)

-+{

-+ int i;

-+ int retval;

-+ struct usb_host_config *actconfig;

-+

-+ /* Explicitly not marked persistent? */

-+ if (!udev->persist_enabled)

-+ return 0;

-+

-+ /* No active config? */

-+ actconfig = udev->actconfig;

-+ if (!actconfig)

-+ return 0;

-+

-+ /* FIXME! We should check whether it's open here or not! */

-+

-+ /*

-+ * Check that all the interface drivers have a

-+ * 'reset_resume' entrypoint

-+ */

-+ retval = 0;

-+ for (i = 0; i < actconfig->desc.bNumInterfaces; i++) {

-+ struct usb_interface *intf;

-+ struct usb_driver *driver;

-+

-+ intf = actconfig->interface[i];

-+ if (!intf->dev.driver)

-+ continue;

-+ driver = to_usb_driver(intf->dev.driver);

-+ if (!driver->reset_resume)

-+ return 0;

-+ /*

-+ * We have at least one driver, and that one

-+ * has a reset_resume method.

-+ */

-+ retval = 1;

-+ }

-+ return retval;

-+}

-+

- static void hub_restart(struct usb_hub *hub, int type)

- {

- struct usb_device *hdev = hub->hdev;

-@@ -689,8 +731,8 @@ static void hub_restart(struct usb_hub *

- * turn off the various status changes to prevent

- * khubd from disconnecting it later.

- */

-- if (udev->persist_enabled && status == 0 &&

-- !(portstatus & USB_PORT_STAT_ENABLE)) {

-+ if (status == 0 && !(portstatus & USB_PORT_STAT_ENABLE) &&

-+ persistent_device(udev)) {

- if (portchange & USB_PORT_STAT_C_ENABLE)

- clear_port_feature(hub->hdev, port1,

- USB_PORT_FEAT_C_ENABLE);

-From mingo@elte.hu Fri Jun 6 14:31:01 2008

-From: Ingo Molnar <mingo@elte.hu>

-Date: Mon, 2 Jun 2008 21:21:03 +0200

-Subject: USB: fix build bug in USB_ISIGHTFW

-To: Matthew Garrett <mjg59@srcf.ucam.org>

-Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, gregkh@suse.de, bersace03@laposte.net, johannes@sipsolutions.de

-Message-ID: <20080602192103.GA31589@elte.hu>

-Content-Disposition: inline

-

-

-From: Ingo Molnar <mingo@elte.hu>

-

-USB: fix build bug in USB_ISIGHTFW

-

--tip tree testing found this build bug:

-

- drivers/built-in.o: In function `isight_firmware_load':

- isight_firmware.c:(.text+0x1ade08): undefined reference to `request_firmware'

- isight_firmware.c:(.text+0x1adf9c): undefined reference to `release_firmware'

-

-select FW_LOADER in USB_ISIGHTFW.

-

-

-From: Ingo Molnar <mingo@elte.hu>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

-

----

- drivers/usb/misc/Kconfig | 1 +

- 1 file changed, 1 insertion(+)

-

---- a/drivers/usb/misc/Kconfig

-+++ b/drivers/usb/misc/Kconfig

-@@ -272,6 +272,7 @@ config USB_TEST

- config USB_ISIGHTFW

- tristate "iSight firmware loading support"

- depends on USB

-+ select FW_LOADER

- help

- This driver loads firmware for USB Apple iSight cameras, allowing

- them to be driven by the USB video class driver available at

-From ncase@xes-inc.com Fri Jun 6 15:07:08 2008

-From: Nate Case <ncase@xes-inc.com>

-Date: Wed, 21 May 2008 16:28:20 -0500

-Subject: USB: isp1760: Assign resource fields before adding hcd

-To: Sebastian Siewior <bigeasy@linutronix.de>

-Cc: Greg Kroah-Hartman <gregkh@suse.de>, linux-usb@vger.kernel.org, linuxppc-dev <linuxppc-dev@ozlabs.org>

-Message-ID: <1211405300.13845.627.camel@localhost.localdomain>

-

-

-This fixes the bogus "io mem 0x00000000" message printed

-during driver init due to hcd->rsrc_start being assigned after

-the call to usb_add_hcd().

-

-Signed-off-by: Nate Case <ncase@xes-inc.com>

-Acked-by: Sebastian Siewior <bigeasy@linutronix.de>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/usb/host/isp1760-hcd.c | 8 ++++----

- 1 file changed, 4 insertions(+), 4 deletions(-)

-

---- a/drivers/usb/host/isp1760-hcd.c

-+++ b/drivers/usb/host/isp1760-hcd.c

-@@ -2207,14 +2207,14 @@ struct usb_hcd *isp1760_register(u64 res

- goto err_put;

- }

-

-- ret = usb_add_hcd(hcd, irq, irqflags);

-- if (ret)

-- goto err_unmap;

--

- hcd->irq = irq;

- hcd->rsrc_start = res_start;

- hcd->rsrc_len = res_len;

-

-+ ret = usb_add_hcd(hcd, irq, irqflags);

-+ if (ret)

-+ goto err_unmap;

-+

- return hcd;

-

- err_unmap: