stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Alan Stern <stern@rowland.harvard.edu>,
	Johan Hovold <johan@kernel.org>
Subject: [PATCH 3.18 20/32] USB: hub: fix SS max number of ports
Date: Mon, 19 Jun 2017 23:21:04 +0800	[thread overview]
Message-ID: <20170619152036.851488354@linuxfoundation.org> (raw)
In-Reply-To: <20170619152035.750974520@linuxfoundation.org>

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 93491ced3c87c94b12220dbac0527e1356702179 upstream.

Add define for the maximum number of ports on a SuperSpeed hub as per
USB 3.1 spec Table 10-5, and use it when verifying the retrieved hub
descriptor.

This specifically avoids benign attempts to update the DeviceRemovable
mask for non-existing ports (should we get that far).

Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/hub.c        |    8 +++++++-
 include/uapi/linux/usb/ch11.h |    3 +++
 2 files changed, 10 insertions(+), 1 deletion(-)

--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1346,7 +1346,13 @@ static int hub_configure(struct usb_hub
 	if (ret < 0) {
 		message = "can't read hub descriptor";
 		goto fail;
-	} else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) {
+	}
+
+	maxchild = USB_MAXCHILDREN;
+	if (hub_is_superspeed(hdev))
+		maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS);
+
+	if (hub->descriptor->bNbrPorts > maxchild) {
 		message = "hub has too many ports!";
 		ret = -ENODEV;
 		goto fail;
--- a/include/uapi/linux/usb/ch11.h
+++ b/include/uapi/linux/usb/ch11.h
@@ -22,6 +22,9 @@
  */
 #define USB_MAXCHILDREN		31
 
+/* See USB 3.1 spec Table 10-5 */
+#define USB_SS_MAXPORTS		15
+
 /*
  * Hub request types
  */

  parent reply	other threads:[~2017-06-19 15:33 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-06-19 15:20 [PATCH 3.18 00/32] 3.18.58-stable review Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 01/32] s390/vmem: fix identity mapping Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 02/32] partitions/msdos: FreeBSD UFS2 file systems are not recognized Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 03/32] Call echo service immediately after socket reconnect Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 04/32] net: xilinx_emaclite: fix freezes due to unordered I/O Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 05/32] net: xilinx_emaclite: fix receive buffer overflow Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 06/32] ipv6: Handle IPv4-mapped src to in6addr_any dst Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 07/32] ipv6: Inhibit IPv4-mapped src address on the wire Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 08/32] log2: make order_base_2() behave correctly on const input value zero Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 09/32] sparc64: make string buffers large enough Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 10/32] configfs: Fix race between create_link and configfs_rmdir Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 11/32] can: gs_usb: fix memory leak in gs_cmd_reset() Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 13/32] [media] vb2: Fix an off by one error in vb2_plane_vaddr Greg Kroah-Hartman
2017-06-19 15:20 ` [PATCH 3.18 14/32] mac80211: dont look at the PM bit of BAR frames Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 16/32] x86/mm/32: Set the __vmalloc_start_set flag in initmem_init() Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 17/32] mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 18/32] staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data() Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 19/32] iio: proximity: as3935: recalibrate RCO after resume Greg Kroah-Hartman
2017-06-19 15:21 ` Greg Kroah-Hartman [this message]
2017-06-19 15:21 ` [PATCH 3.18 21/32] usb: core: fix potential memory leak in error path during hcd creation Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 22/32] [media] pvrusb2: reduce stack usage pvr2_eeprom_analyze() Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 23/32] USB: gadget: dummy_hcd: fix hub-descriptor removable fields Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 24/32] usb: r8a66597-hcd: select a different endpoint on timeout Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 25/32] usb: r8a66597-hcd: decrease timeout Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 26/32] drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR() Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 27/32] usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 28/32] mm/memory-failure.c: use compound_head() flags for huge pages Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 29/32] swap: cond_resched in swap_cgroup_prepare() Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 30/32] genirq: Release resources in __setup_irq() error path Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 31/32] alarmtimer: Rate limit periodic intervals Greg Kroah-Hartman
2017-06-19 15:21 ` [PATCH 3.18 32/32] mm: larger stack guard gap, between vmas Greg Kroah-Hartman
2017-06-21  5:49   ` Hugh Dickins
2017-06-21  5:59     ` Willy Tarreau
2017-06-21  6:10       ` Hugh Dickins
2017-06-21  7:24         ` Willy Tarreau
2017-06-24 15:04     ` Greg Kroah-Hartman
2017-06-19 22:47 ` [PATCH 3.18 00/32] 3.18.58-stable review Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170619152036.851488354@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=johan@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=stern@rowland.harvard.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).