* Patch "USB: serial: io_ti: fix div-by-zero in set_termios" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:43 UTC (permalink / raw)
To: johan, gregkh; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
USB: serial: io_ti: fix div-by-zero in set_termios
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 6aeb75e6adfaed16e58780309613a578fe1ee90b Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 11 May 2017 11:41:21 +0200
Subject: USB: serial: io_ti: fix div-by-zero in set_termios
From: Johan Hovold <johan@kernel.org>
commit 6aeb75e6adfaed16e58780309613a578fe1ee90b upstream.
Fix a division-by-zero in set_termios when debugging is enabled and a
high-enough speed has been requested so that the divisor value becomes
zero.
Instead of just fixing the offending debug statement, cap the baud rate
at the base as a zero divisor value also appears to crash the firmware.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/io_ti.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2349,8 +2349,11 @@ static void change_port_settings(struct
if (!baud) {
/* pick a default, any default... */
baud = 9600;
- } else
+ } else {
+ /* Avoid a zero divisor. */
+ baud = min(baud, 461550);
tty_encode_baud_rate(tty, baud, baud);
+ }
edge_port->baud_rate = baud;
config->wBaudRate = (__u16)((461550L + baud/2) / baud);
Patches currently in stable-queue which might be from johan@kernel.org are
queue-4.9/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-4.9/usb-chaoskey-fix-alea-quirk-on-big-endian-hosts.patch
queue-4.9/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-4.9/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-4.9/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-4.9/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-4.9/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-4.9/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-4.9/usb-serial-option-add-telit-me910-support.patch
queue-4.9/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-4.9/of-fdt-add-missing-allocation-failure-check.patch
queue-4.9/usbvision-fix-null-deref-at-probe.patch
queue-4.9/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-4.9/usb-ehci-platform-fix-companion-device-leak.patch
queue-4.9/mceusb-fix-null-deref-at-probe.patch
queue-4.9/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-4.9/ath9k_htc-fix-null-deref-at-probe.patch
queue-4.9/usb-musb-fix-trying-to-suspend-while-active-for-otg-configurations.patch
^ permalink raw reply
* Patch "USB: serial: mct_u232: fix big-endian baud-rate handling" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:43 UTC (permalink / raw)
To: johan, gregkh, zaitcev; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
USB: serial: mct_u232: fix big-endian baud-rate handling
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 26cede343656c0bc2c33cdc783771282405c7fb2 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 11 May 2017 11:41:20 +0200
Subject: USB: serial: mct_u232: fix big-endian baud-rate handling
From: Johan Hovold <johan@kernel.org>
commit 26cede343656c0bc2c33cdc783771282405c7fb2 upstream.
Drop erroneous cpu_to_le32 when setting the baud rate, something which
corrupted the divisor on big-endian hosts.
Found using sparse:
warning: incorrect type in argument 1 (different base types)
expected unsigned int [unsigned] [usertype] val
got restricted __le32 [usertype] <noident>
Fixes: af2ac1a091bc ("USB: serial mct_usb232: move DMA buffers to heap")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-By: Pete Zaitcev <zaitcev@yahoo.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/mct_u232.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(struct
return -ENOMEM;
divisor = mct_u232_calculate_baud_rate(serial, value, &speed);
- put_unaligned_le32(cpu_to_le32(divisor), buf);
+ put_unaligned_le32(divisor, buf);
rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
MCT_U232_SET_BAUD_RATE_REQUEST,
MCT_U232_SET_REQUEST_TYPE,
Patches currently in stable-queue which might be from johan@kernel.org are
queue-4.9/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-4.9/usb-chaoskey-fix-alea-quirk-on-big-endian-hosts.patch
queue-4.9/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-4.9/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-4.9/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-4.9/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-4.9/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-4.9/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-4.9/usb-serial-option-add-telit-me910-support.patch
queue-4.9/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-4.9/of-fdt-add-missing-allocation-failure-check.patch
queue-4.9/usbvision-fix-null-deref-at-probe.patch
queue-4.9/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-4.9/usb-ehci-platform-fix-companion-device-leak.patch
queue-4.9/mceusb-fix-null-deref-at-probe.patch
queue-4.9/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-4.9/ath9k_htc-fix-null-deref-at-probe.patch
queue-4.9/usb-musb-fix-trying-to-suspend-while-active-for-otg-configurations.patch
^ permalink raw reply
* Patch "usb: musb: tusb6010_omap: Do not reset the other direction's packet size" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:43 UTC (permalink / raw)
To: peter.ujfalusi, b-liu, gregkh, tony; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: musb: tusb6010_omap: Do not reset the other direction's packet size
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-musb-tusb6010_omap-do-not-reset-the-other-direction-s-packet-size.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 6df2b42f7c040d57d9ecb67244e04e905ab87ac6 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date: Wed, 17 May 2017 11:23:11 -0500
Subject: usb: musb: tusb6010_omap: Do not reset the other direction's packet size
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit 6df2b42f7c040d57d9ecb67244e04e905ab87ac6 upstream.
We have one register for each EP to set the maximum packet size for both
TX and RX.
If for example an RX programming would happen before the previous TX
transfer finishes we would reset the TX packet side.
To fix this issue, only modify the TX or RX part of the register.
Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/musb/tusb6010_omap.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -220,6 +220,7 @@ static int tusb_omap_dma_program(struct
u32 dma_remaining;
int src_burst, dst_burst;
u16 csr;
+ u32 psize;
int ch;
s8 dmareq;
s8 sync_dev;
@@ -391,15 +392,19 @@ static int tusb_omap_dma_program(struct
if (chdat->tx) {
/* Send transfer_packet_sz packets at a time */
- musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
- chdat->transfer_packet_sz);
+ psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+ psize &= ~0x7ff;
+ psize |= chdat->transfer_packet_sz;
+ musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
musb_writel(ep_conf, TUSB_EP_TX_OFFSET,
TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
} else {
/* Receive transfer_packet_sz packets at a time */
- musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
- chdat->transfer_packet_sz << 16);
+ psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+ psize &= ~(0x7ff << 16);
+ psize |= (chdat->transfer_packet_sz << 16);
+ musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
musb_writel(ep_conf, TUSB_EP_RX_OFFSET,
TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
Patches currently in stable-queue which might be from peter.ujfalusi@ti.com are
queue-4.9/usb-musb-fix-trying-to-suspend-while-active-for-otg-configurations.patch
queue-4.9/usb-musb-tusb6010_omap-do-not-reset-the-other-direction-s-packet-size.patch
^ permalink raw reply
* Patch "USB: serial: qcserial: add more Lenovo EM74xx device IDs" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:43 UTC (permalink / raw)
To: bjorn, gregkh, johan; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
USB: serial: qcserial: add more Lenovo EM74xx device IDs
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 8d7a10dd323993cc40bd37bce8bc570133b0c396 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
Date: Wed, 17 May 2017 16:30:50 +0200
Subject: USB: serial: qcserial: add more Lenovo EM74xx device IDs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Bjørn Mork <bjorn@mork.no>
commit 8d7a10dd323993cc40bd37bce8bc570133b0c396 upstream.
In their infinite wisdom, and never ending quest for end user frustration,
Lenovo has decided to use new USB device IDs for the wwan modules in
their 2017 laptops. The actual hardware is still the Sierra Wireless
EM7455 or EM7430, depending on region.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/qcserial.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -162,6 +162,8 @@ static const struct usb_device_id id_tab
{DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */
{DEVICE_SWI(0x1199, 0x9078)}, /* Sierra Wireless EM74xx */
{DEVICE_SWI(0x1199, 0x9079)}, /* Sierra Wireless EM74xx */
+ {DEVICE_SWI(0x1199, 0x907a)}, /* Sierra Wireless EM74xx QDL */
+ {DEVICE_SWI(0x1199, 0x907b)}, /* Sierra Wireless EM74xx */
{DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
{DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
{DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
Patches currently in stable-queue which might be from bjorn@mork.no are
queue-4.9/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
^ permalink raw reply
* Patch "[media] usbvision: fix NULL-deref at probe" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:43 UTC (permalink / raw)
To: johan, gregkh, hans.verkuil, mchehab, thierry.merle
Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] usbvision: fix NULL-deref at probe
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usbvision-fix-null-deref-at-probe.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From eacb975b48272f54532b62f515a3cf7eefa35123 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 13 Mar 2017 09:53:55 -0300
Subject: [media] usbvision: fix NULL-deref at probe
From: Johan Hovold <johan@kernel.org>
commit eacb975b48272f54532b62f515a3cf7eefa35123 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
Fixes: 2a9f8b5d25be ("V4L/DVB (5206): Usbvision: set alternate interface
modification")
Cc: Thierry MERLE <thierry.merle@free.fr>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/usbvision/usbvision-video.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -1506,7 +1506,14 @@ static int usbvision_probe(struct usb_in
}
for (i = 0; i < usbvision->num_alt; i++) {
- u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[1].desc.
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < 2) {
+ ret = -ENODEV;
+ goto err_pkt;
+ }
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[1].desc.
wMaxPacketSize);
usbvision->alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
Patches currently in stable-queue which might be from johan@kernel.org are
queue-4.9/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-4.9/usb-chaoskey-fix-alea-quirk-on-big-endian-hosts.patch
queue-4.9/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-4.9/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-4.9/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-4.9/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-4.9/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-4.9/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-4.9/usb-serial-option-add-telit-me910-support.patch
queue-4.9/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-4.9/of-fdt-add-missing-allocation-failure-check.patch
queue-4.9/usbvision-fix-null-deref-at-probe.patch
queue-4.9/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-4.9/usb-ehci-platform-fix-companion-device-leak.patch
queue-4.9/mceusb-fix-null-deref-at-probe.patch
queue-4.9/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-4.9/ath9k_htc-fix-null-deref-at-probe.patch
queue-4.9/usb-musb-fix-trying-to-suspend-while-active-for-otg-configurations.patch
^ permalink raw reply
* Patch "usb: serial: option: add Telit ME910 support" has been added to the 4.9-stable tree
From: gregkh @ 2017-05-23 12:43 UTC (permalink / raw)
To: dnlplm, gregkh, johan; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
usb: serial: option: add Telit ME910 support
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-serial-option-add-telit-me910-support.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 40dd46048c155b8f0683f468c950a1c107f77a7c Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Wed, 3 May 2017 10:28:54 +0200
Subject: usb: serial: option: add Telit ME910 support
From: Daniele Palmas <dnlplm@gmail.com>
commit 40dd46048c155b8f0683f468c950a1c107f77a7c upstream.
This patch adds support for Telit ME910 PID 0x1100.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -281,6 +281,7 @@ static void option_instat_callback(struc
#define TELIT_PRODUCT_LE922_USBCFG0 0x1042
#define TELIT_PRODUCT_LE922_USBCFG3 0x1043
#define TELIT_PRODUCT_LE922_USBCFG5 0x1045
+#define TELIT_PRODUCT_ME910 0x1100
#define TELIT_PRODUCT_LE920 0x1200
#define TELIT_PRODUCT_LE910 0x1201
#define TELIT_PRODUCT_LE910_USBCFG4 0x1206
@@ -640,6 +641,11 @@ static const struct option_blacklist_inf
.reserved = BIT(5) | BIT(6),
};
+static const struct option_blacklist_info telit_me910_blacklist = {
+ .sendsetup = BIT(0),
+ .reserved = BIT(1) | BIT(3),
+};
+
static const struct option_blacklist_info telit_le910_blacklist = {
.sendsetup = BIT(0),
.reserved = BIT(1) | BIT(2),
@@ -1235,6 +1241,8 @@ static const struct usb_device_id option
.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = (kernel_ulong_t)&telit_me910_blacklist },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
.driver_info = (kernel_ulong_t)&telit_le910_blacklist },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
Patches currently in stable-queue which might be from dnlplm@gmail.com are
queue-4.9/usb-serial-option-add-telit-me910-support.patch
^ permalink raw reply
* Re: Patch "usb: host: ehci-platform: fix usb 1.1 device is not connected in system resume" has been added to the 4.11-stable tree
From: Greg KH @ 2017-05-23 12:50 UTC (permalink / raw)
To: yoshihiro.shimoda.uh; +Cc: stable, stable-commits
In-Reply-To: <1495543242272@kroah.com>
Oops, nope, I had to drop this from the stable queues, as it breaks the
build. Can you provide a backport if you think it is necessary for the
stable kernels?
thanks,
greg k-h
On Tue, May 23, 2017 at 02:40:42PM +0200, gregkh@linuxfoundation.org wrote:
>
> This is a note to let you know that I've just added the patch titled
>
> usb: host: ehci-platform: fix usb 1.1 device is not connected in system resume
>
> to the 4.11-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>
> The filename of the patch is:
> usb-host-ehci-platform-fix-usb-1.1-device-is-not-connected-in-system-resume.patch
> and it can be found in the queue-4.11 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
>
>
> >From d4d75128b8fd727d42c775a16b41634d09409dba Mon Sep 17 00:00:00 2001
> From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
> Date: Tue, 21 Feb 2017 19:59:48 +0900
> Subject: usb: host: ehci-platform: fix usb 1.1 device is not connected in system resume
>
> From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
>
> commit d4d75128b8fd727d42c775a16b41634d09409dba upstream.
>
> This patch fixes an issue that a usb 1.1 device is not connected in
> system resume and then the following message appeared if debug messages
> are enabled:
> usb 2-1: Waited 2000ms for CONNECT
>
> To resolve this issue, the EHCI controller must be resumed after its
> companion controllers. So, this patch adds such code on the driver.
>
> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/usb/host/ehci-platform.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> --- a/drivers/usb/host/ehci-platform.c
> +++ b/drivers/usb/host/ehci-platform.c
> @@ -34,6 +34,7 @@
> #include <linux/usb.h>
> #include <linux/usb/hcd.h>
> #include <linux/usb/ehci_pdriver.h>
> +#include <linux/usb/of.h>
>
> #include "ehci.h"
>
> @@ -297,6 +298,7 @@ static int ehci_platform_probe(struct pl
> goto err_power;
>
> device_wakeup_enable(hcd->self.controller);
> + device_enable_async_suspend(hcd->self.controller);
> platform_set_drvdata(dev, hcd);
>
> return err;
> @@ -370,6 +372,7 @@ static int ehci_platform_resume(struct d
> struct usb_ehci_pdata *pdata = dev_get_platdata(dev);
> struct platform_device *pdev = to_platform_device(dev);
> struct ehci_platform_priv *priv = hcd_to_ehci_priv(hcd);
> + struct device *companion_dev;
>
> if (pdata->power_on) {
> int err = pdata->power_on(pdev);
> @@ -377,6 +380,10 @@ static int ehci_platform_resume(struct d
> return err;
> }
>
> + companion_dev = usb_of_get_companion_dev(hcd->self.controller);
> + if (companion_dev)
> + device_pm_wait_for_dev(hcd->self.controller, companion_dev);
> +
> ehci_resume(hcd, priv->reset_on_resume);
> return 0;
> }
>
>
> Patches currently in stable-queue which might be from yoshihiro.shimoda.uh@renesas.com are
>
> queue-4.11/usb-host-ehci-platform-fix-usb-1.1-device-is-not-connected-in-system-resume.patch
> queue-4.11/usb-ehci-platform-fix-companion-device-leak.patch
^ permalink raw reply
* Re: Patch "USB: ehci-platform: fix companion-device leak" has been added to the 4.11-stable tree
From: Greg KH @ 2017-05-23 12:51 UTC (permalink / raw)
To: johan, stern, yoshihiro.shimoda.uh; +Cc: stable, stable-commits
In-Reply-To: <1495543240635@kroah.com>
Had to drop this one as well as the previous patch which this depends on
broke the build. If this is needed in the stable trees, also please
provide a working backport.
thanks,
greg k-h
On Tue, May 23, 2017 at 02:40:40PM +0200, gregkh@linuxfoundation.org wrote:
>
> This is a note to let you know that I've just added the patch titled
>
> USB: ehci-platform: fix companion-device leak
>
> to the 4.11-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>
> The filename of the patch is:
> usb-ehci-platform-fix-companion-device-leak.patch
> and it can be found in the queue-4.11 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
>
>
> >From a7415477a20448bbb7d13765784c0b29249a176f Mon Sep 17 00:00:00 2001
> From: Johan Hovold <johan@kernel.org>
> Date: Tue, 16 May 2017 16:26:13 +0200
> Subject: USB: ehci-platform: fix companion-device leak
>
> From: Johan Hovold <johan@kernel.org>
>
> commit a7415477a20448bbb7d13765784c0b29249a176f upstream.
>
> Make sure do drop the reference taken to the companion device during
> resume.
>
> Fixes: d4d75128b8fd ("usb: host: ehci-platform: fix usb 1.1 device is not connected in system resume")
> Signed-off-by: Johan Hovold <johan@kernel.org>
> Acked-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
> Acked-by: Alan Stern <stern@rowland.harvard.edu>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/usb/host/ehci-platform.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> --- a/drivers/usb/host/ehci-platform.c
> +++ b/drivers/usb/host/ehci-platform.c
> @@ -381,8 +381,10 @@ static int ehci_platform_resume(struct d
> }
>
> companion_dev = usb_of_get_companion_dev(hcd->self.controller);
> - if (companion_dev)
> + if (companion_dev) {
> device_pm_wait_for_dev(hcd->self.controller, companion_dev);
> + put_device(companion_dev);
> + }
>
> ehci_resume(hcd, priv->reset_on_resume);
> return 0;
>
>
> Patches currently in stable-queue which might be from johan@kernel.org are
>
> queue-4.11/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
> queue-4.11/usb-chaoskey-fix-alea-quirk-on-big-endian-hosts.patch
> queue-4.11/usb-hub-fix-non-ss-hub-descriptor-handling.patch
> queue-4.11/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
> queue-4.11/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
> queue-4.11/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
> queue-4.11/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
> queue-4.11/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
> queue-4.11/usb-serial-option-add-telit-me910-support.patch
> queue-4.11/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
> queue-4.11/of-fdt-add-missing-allocation-failure-check.patch
> queue-4.11/usbvision-fix-null-deref-at-probe.patch
> queue-4.11/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
> queue-4.11/usb-ehci-platform-fix-companion-device-leak.patch
> queue-4.11/mceusb-fix-null-deref-at-probe.patch
> queue-4.11/usb-hub-fix-ss-hub-descriptor-handling.patch
> queue-4.11/ath9k_htc-fix-null-deref-at-probe.patch
> queue-4.11/usb-musb-fix-trying-to-suspend-while-active-for-otg-configurations.patch
^ permalink raw reply
* Re: [PATCH 0/2] nohz: Deal with clock reprogram skipping issues v3
From: Frederic Weisbecker @ 2017-05-23 13:10 UTC (permalink / raw)
To: Ingo Molnar
Cc: LKML, Peter Zijlstra, Rik van Riel, James Hartsock,
Thomas Gleixner, stable, Tim Wright, Pavel Machek
In-Reply-To: <20170523072508.3bzyipgwnyjcbef6@gmail.com>
On Tue, May 23, 2017 at 09:25:08AM +0200, Ingo Molnar wrote:
>
> * Frederic Weisbecker <fweisbec@gmail.com> wrote:
>
> > v2 had issues on -tip tree and triggered a warning. It seems to have
> > disappeared. Perhaps it was due to another timer issue. Anyway this
> > version brings more debugging informations, with a layout that is more
> > bisection-friendly and it also handles ticks that fire outside IRQ
> > context and thus carry NULL irq regs. This happen when
> > hrtimer_interrupt() is called on hotplug cpu down for example.
> >
> > We'll see if the issue arises again.
> >
> > git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks.git
> > nohz/fixes
> >
> > HEAD: cd15f46b284f04dbedd065a9d99a4e0badae379a
> >
> > Thanks,
> > Frederic
> > ---
> >
> > Frederic Weisbecker (2):
> > nohz: Add hrtimer sanity check
> > nohz: Fix collision between tick and other hrtimers, again
> >
> >
> > kernel/time/tick-sched.c | 48 +++++++++++++++++++++++++++++++++++++++++++-----
> > kernel/time/tick-sched.h | 2 ++
> > 2 files changed, 45 insertions(+), 5 deletions(-)
>
> So I think the 3 commits queued up right now:
>
> 99fa871820cf: nohz: Reset next_tick cache even when the timer has no regs
> 411fe24e6b7c: nohz: Fix collision between tick and other hrtimers, again
> ce6cf9a15d62: nohz: Add hrtimer sanity check
>
> are OK and I'd not rebase them unless there's some breakage.
>
> One thing I noticed: your second series does appear to have:
>
> 99fa871820cf: nohz: Reset next_tick cache even when the timer has no regs
>
> is that intentional? That is pretty much the only commit I'd love to rebase with a
> proper description added.
Yes in my latest series I melted "nohz: Reset next_tick cache even when the timer has no regs"
into "nohz: Fix collision between tick and other hrtimers, again" because it's a fixup and
keeping that patch separate may break bisection.
So ideally, it would be nice if you could fixup 411fe24e6b7c with 99fa871820cf. That's roughly
all I did in my latest series.
Thanks!
^ permalink raw reply
* FAILED: patch "[PATCH] [media] dw2102: limit messages to buffer size" failed to apply to 4.4-stable tree
From: gregkh @ 2017-05-23 13:22 UTC (permalink / raw)
To: amilburn, mchehab; +Cc: stable
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 950e252cb469f323740d78e4907843acef89eedb Mon Sep 17 00:00:00 2001
From: Alyssa Milburn <amilburn@zall.org>
Date: Sat, 1 Apr 2017 14:34:49 -0300
Subject: [PATCH] [media] dw2102: limit messages to buffer size
Otherwise the i2c transfer functions can read or write beyond the end of
stack or heap buffers.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 4f42d57f81d9..6e654e5026dd 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -204,6 +204,20 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapter *adap,
switch (num) {
case 2:
+ if (msg[0].len != 1) {
+ warn("i2c rd: len=%d is not 1!\n",
+ msg[0].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
+ if (2 + msg[1].len > sizeof(buf6)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[1].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
/* read si2109 register by number */
buf6[0] = msg[0].addr << 1;
buf6[1] = msg[0].len;
@@ -219,6 +233,13 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapter *adap,
case 1:
switch (msg[0].addr) {
case 0x68:
+ if (2 + msg[0].len > sizeof(buf6)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[0].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
/* write to si2109 register */
buf6[0] = msg[0].addr << 1;
buf6[1] = msg[0].len;
@@ -262,6 +283,13 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
/* first write first register number */
u8 ibuf[MAX_XFER_SIZE], obuf[3];
+ if (2 + msg[0].len != sizeof(obuf)) {
+ warn("i2c rd: len=%d is not 1!\n",
+ msg[0].len);
+ ret = -EOPNOTSUPP;
+ goto unlock;
+ }
+
if (2 + msg[1].len > sizeof(ibuf)) {
warn("i2c rd: len=%d is too big!\n",
msg[1].len);
@@ -462,6 +490,12 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
/* first write first register number */
u8 ibuf[MAX_XFER_SIZE], obuf[3];
+ if (2 + msg[0].len != sizeof(obuf)) {
+ warn("i2c rd: len=%d is not 1!\n",
+ msg[0].len);
+ ret = -EOPNOTSUPP;
+ goto unlock;
+ }
if (2 + msg[1].len > sizeof(ibuf)) {
warn("i2c rd: len=%d is too big!\n",
msg[1].len);
@@ -696,6 +730,13 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
msg[0].buf[0] = state->data[1];
break;
default:
+ if (3 + msg[0].len > sizeof(state->data)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[0].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
/* always i2c write*/
state->data[0] = 0x08;
state->data[1] = msg[0].addr;
@@ -711,6 +752,19 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
break;
case 2:
/* always i2c read */
+ if (4 + msg[0].len > sizeof(state->data)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[0].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+ if (1 + msg[1].len > sizeof(state->data)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[1].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
state->data[0] = 0x09;
state->data[1] = msg[0].len;
state->data[2] = msg[1].len;
^ permalink raw reply related
* FAILED: patch "[PATCH] [media] dw2102: limit messages to buffer size" failed to apply to 3.18-stable tree
From: gregkh @ 2017-05-23 13:22 UTC (permalink / raw)
To: amilburn, mchehab; +Cc: stable
The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 950e252cb469f323740d78e4907843acef89eedb Mon Sep 17 00:00:00 2001
From: Alyssa Milburn <amilburn@zall.org>
Date: Sat, 1 Apr 2017 14:34:49 -0300
Subject: [PATCH] [media] dw2102: limit messages to buffer size
Otherwise the i2c transfer functions can read or write beyond the end of
stack or heap buffers.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 4f42d57f81d9..6e654e5026dd 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -204,6 +204,20 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapter *adap,
switch (num) {
case 2:
+ if (msg[0].len != 1) {
+ warn("i2c rd: len=%d is not 1!\n",
+ msg[0].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
+ if (2 + msg[1].len > sizeof(buf6)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[1].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
/* read si2109 register by number */
buf6[0] = msg[0].addr << 1;
buf6[1] = msg[0].len;
@@ -219,6 +233,13 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapter *adap,
case 1:
switch (msg[0].addr) {
case 0x68:
+ if (2 + msg[0].len > sizeof(buf6)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[0].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
/* write to si2109 register */
buf6[0] = msg[0].addr << 1;
buf6[1] = msg[0].len;
@@ -262,6 +283,13 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
/* first write first register number */
u8 ibuf[MAX_XFER_SIZE], obuf[3];
+ if (2 + msg[0].len != sizeof(obuf)) {
+ warn("i2c rd: len=%d is not 1!\n",
+ msg[0].len);
+ ret = -EOPNOTSUPP;
+ goto unlock;
+ }
+
if (2 + msg[1].len > sizeof(ibuf)) {
warn("i2c rd: len=%d is too big!\n",
msg[1].len);
@@ -462,6 +490,12 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
/* first write first register number */
u8 ibuf[MAX_XFER_SIZE], obuf[3];
+ if (2 + msg[0].len != sizeof(obuf)) {
+ warn("i2c rd: len=%d is not 1!\n",
+ msg[0].len);
+ ret = -EOPNOTSUPP;
+ goto unlock;
+ }
if (2 + msg[1].len > sizeof(ibuf)) {
warn("i2c rd: len=%d is too big!\n",
msg[1].len);
@@ -696,6 +730,13 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
msg[0].buf[0] = state->data[1];
break;
default:
+ if (3 + msg[0].len > sizeof(state->data)) {
+ warn("i2c wr: len=%d is too big!\n",
+ msg[0].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
/* always i2c write*/
state->data[0] = 0x08;
state->data[1] = msg[0].addr;
@@ -711,6 +752,19 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
break;
case 2:
/* always i2c read */
+ if (4 + msg[0].len > sizeof(state->data)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[0].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+ if (1 + msg[1].len > sizeof(state->data)) {
+ warn("i2c rd: len=%d is too big!\n",
+ msg[1].len);
+ num = -EOPNOTSUPP;
+ break;
+ }
+
state->data[0] = 0x09;
state->data[1] = msg[0].len;
state->data[2] = msg[1].len;
^ permalink raw reply related
* FAILED: patch "[PATCH] [media] ov2640: fix vflip control" failed to apply to 4.11-stable tree
From: gregkh @ 2017-05-23 13:23 UTC (permalink / raw)
To: fschaefer.oss, mchehab, stable; +Cc: stable
The patch below does not apply to the 4.11-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 7f140fc2064bcd23e0490d8210650e2ef21c1c89 Mon Sep 17 00:00:00 2001
From: Frank Schaefer <fschaefer.oss@googlemail.com>
Date: Sun, 16 Apr 2017 14:35:45 -0300
Subject: [PATCH] [media] ov2640: fix vflip control
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Enabling vflip currently causes wrong colors.
It seems that (at least with the current sensor setup) REG04_VFLIP_IMG only
changes the vertical readout direction.
Because pixels are arranged RGRG... in odd lines and GBGB... in even lines,
either a one line shift or even/odd line swap is required, too, but
apparently this doesn't happen.
I finally figured out that this can be done manually by setting
REG04_VREF_EN.
Looking at hflip, it turns out that bit REG04_HREF_EN is set there
permanetly, but according to my tests has no effect on the pixel readout
order.
So my conclusion is that the current documentation of sensor register 0x04
is wrong (has changed after preliminary datasheet version 2.2).
I'm pretty sure that automatic vertical line shift/switch can be enabled,
too, but until anyone finds ot how this works, we have to stick with manual
switching.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
diff --git a/drivers/media/i2c/ov2640.c b/drivers/media/i2c/ov2640.c
index 8acdb6098d3f..6709e4de12ca 100644
--- a/drivers/media/i2c/ov2640.c
+++ b/drivers/media/i2c/ov2640.c
@@ -716,8 +716,10 @@ static int ov2640_s_ctrl(struct v4l2_ctrl *ctrl)
switch (ctrl->id) {
case V4L2_CID_VFLIP:
- val = ctrl->val ? REG04_VFLIP_IMG : 0x00;
- return ov2640_mask_set(client, REG04, REG04_VFLIP_IMG, val);
+ val = ctrl->val ? REG04_VFLIP_IMG | REG04_VREF_EN : 0x00;
+ return ov2640_mask_set(client, REG04,
+ REG04_VFLIP_IMG | REG04_VREF_EN, val);
+ /* NOTE: REG04_VREF_EN: 1 line shift / even/odd line swap */
case V4L2_CID_HFLIP:
val = ctrl->val ? REG04_HFLIP_IMG : 0x00;
return ov2640_mask_set(client, REG04, REG04_HFLIP_IMG, val);
^ permalink raw reply related
* FAILED: patch "[PATCH] [media] digitv: limit messages to buffer size" failed to apply to 4.4-stable tree
From: gregkh @ 2017-05-23 13:23 UTC (permalink / raw)
To: amilburn, mchehab; +Cc: stable
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 821117dc21083a99dd99174c10848d70ff43de29 Mon Sep 17 00:00:00 2001
From: Alyssa Milburn <amilburn@zall.org>
Date: Sat, 1 Apr 2017 14:33:42 -0300
Subject: [PATCH] [media] digitv: limit messages to buffer size
Return an error rather than memcpy()ing beyond the end of the buffer.
Internal callers use appropriate sizes, but digitv_i2c_xfer may not.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
index 4284f6984dc1..475a3c0cdee7 100644
--- a/drivers/media/usb/dvb-usb/digitv.c
+++ b/drivers/media/usb/dvb-usb/digitv.c
@@ -33,6 +33,9 @@ static int digitv_ctrl_msg(struct dvb_usb_device *d,
wo = (rbuf == NULL || rlen == 0); /* write-only */
+ if (wlen > 4 || rlen > 4)
+ return -EIO;
+
memset(st->sndbuf, 0, 7);
memset(st->rcvbuf, 0, 7);
^ permalink raw reply related
* FAILED: patch "[PATCH] [media] digitv: limit messages to buffer size" failed to apply to 3.18-stable tree
From: gregkh @ 2017-05-23 13:23 UTC (permalink / raw)
To: amilburn, mchehab; +Cc: stable
The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 821117dc21083a99dd99174c10848d70ff43de29 Mon Sep 17 00:00:00 2001
From: Alyssa Milburn <amilburn@zall.org>
Date: Sat, 1 Apr 2017 14:33:42 -0300
Subject: [PATCH] [media] digitv: limit messages to buffer size
Return an error rather than memcpy()ing beyond the end of the buffer.
Internal callers use appropriate sizes, but digitv_i2c_xfer may not.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
index 4284f6984dc1..475a3c0cdee7 100644
--- a/drivers/media/usb/dvb-usb/digitv.c
+++ b/drivers/media/usb/dvb-usb/digitv.c
@@ -33,6 +33,9 @@ static int digitv_ctrl_msg(struct dvb_usb_device *d,
wo = (rbuf == NULL || rlen == 0); /* write-only */
+ if (wlen > 4 || rlen > 4)
+ return -EIO;
+
memset(st->sndbuf, 0, 7);
memset(st->rcvbuf, 0, 7);
^ permalink raw reply related
* Re: FAILED: patch "[PATCH] [media] dvb-usb-firmware: don't do DMA on stack" failed to apply to 4.11-stable tree
From: Brüns, Stefan @ 2017-05-23 13:28 UTC (permalink / raw)
To: stable@vger.kernel.org
Cc: gregkh@linuxfoundation.org, mchehab@s-opensource.com
In-Reply-To: <1495542835161183@kroah.com>
On Dienstag, 23. Mai 2017 14:33:55 CEST gregkh@linuxfoundation.org wrote:
> The patch below does not apply to the 4.11-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
Please apply this:
67b0503db9c29b04eadfeede6bebbfe5ddad94ef ("[media] dvb-usb-firmware: don't do
DMA on stack")
on top of commit:
43fab9793c1f44e665b4f98035a14942edf03ddc ("[media] dvb-usb: don't use stack
for firmware load")
(both from mainline)
Kind regards,
Stefan
> ------------------ original commit in Linus's tree ------------------
>
> From f9fa0f2bebaa629aff839b7b992298b1fce453d2 Mon Sep 17 00:00:00 2001
> From: =?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
> Date: Sun, 12 Feb 2017 13:02:13 -0200
> Subject: [PATCH] [media] dvb-usb-firmware: don't do DMA on stack
> MIME-Version: 1.0
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: 8bit
>
> The buffer allocation for the firmware data was changed in
> commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
> but the same applies for the reset value.
>
> Fixes: 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
> Cc: stable@vger.kernel.org
> Signed-off-by: Stefan Br�ns <stefan.bruens@rwth-aachen.de>
> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
>
> diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
> b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c index
> ab9866024ec7..04033efe7ad5 100644
> --- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
> +++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
> @@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct usb_device
> *udev,u16 addr,u8 *data, u8 le int usb_cypress_load_firmware(struct
> usb_device *udev, const struct firmware *fw, int type) {
> struct hexline *hx;
> - u8 reset;
> - int ret,pos=0;
> + u8 *buf;
> + int ret, pos = 0;
> + u16 cpu_cs_register = cypress[type].cpu_cs_register;
>
> - hx = kmalloc(sizeof(*hx), GFP_KERNEL);
> - if (!hx)
> + buf = kmalloc(sizeof(*hx), GFP_KERNEL);
> + if (!buf)
> return -ENOMEM;
> + hx = (struct hexline *)buf;
>
> /* stop the CPU */
> - reset = 1;
> - if ((ret =
> usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
> + buf[0] = 1;
> + if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
> err("could not stop the USB controller CPU.");
>
> while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
> @@ -61,21 +63,21 @@ int usb_cypress_load_firmware(struct usb_device *udev,
> const struct firmware *fw }
> if (ret < 0) {
> err("firmware download failed at %d with %d",pos,ret);
> - kfree(hx);
> + kfree(buf);
> return ret;
> }
>
> if (ret == 0) {
> /* restart the CPU */
> - reset = 0;
> - if (ret ||
> usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
> + buf[0] = 0;
> + if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
> err("could not restart the USB controller CPU.");
> ret = -EINVAL;
> }
> } else
> ret = -EIO;
>
> - kfree(hx);
> + kfree(buf);
>
> return ret;
> }
^ permalink raw reply
* Patch "[media] cx231xx-audio: fix NULL-deref at probe" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: johan, Srinivasa.Deevi, gregkh, hans.verkuil, mchehab
Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] cx231xx-audio: fix NULL-deref at probe
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
cx231xx-audio-fix-null-deref-at-probe.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 65f921647f4c89a2068478c89691f39b309b58f7 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 13 Mar 2017 09:53:58 -0300
Subject: [media] cx231xx-audio: fix NULL-deref at probe
From: Johan Hovold <johan@kernel.org>
commit 65f921647f4c89a2068478c89691f39b309b58f7 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cx231xx/cx231xx-audio.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -702,6 +702,11 @@ static int cx231xx_audio_init(struct cx2
hs_config_info[0].interface_info.
audio_index + 1];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) {
+ snd_card_free(card);
+ return -ENODEV;
+ }
+
adev->end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].desc.
bEndpointAddress;
@@ -717,8 +722,14 @@ static int cx231xx_audio_init(struct cx2
}
for (i = 0; i < adev->num_alt; i++) {
- u16 tmp =
- le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) {
+ snd_card_free(card);
+ return -ENODEV;
+ }
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
wMaxPacketSize);
adev->alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/cx231xx-audio-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/cx231xx-cards-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/gspca-konica-add-missing-endpoint-sanity-check.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/dib0700-fix-null-deref-at-probe.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* Patch "[media] cx231xx-cards: fix NULL-deref at probe" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: johan, Srinivasa.Deevi, gregkh, hans.verkuil, mchehab
Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] cx231xx-cards: fix NULL-deref at probe
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
cx231xx-cards-fix-null-deref-at-probe.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 0cd273bb5e4d1828efaaa8dfd11b7928131ed149 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 13 Mar 2017 09:53:56 -0300
Subject: [media] cx231xx-cards: fix NULL-deref at probe
From: Johan Hovold <johan@kernel.org>
commit 0cd273bb5e4d1828efaaa8dfd11b7928131ed149 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cx231xx/cx231xx-cards.c | 45 ++++++++++++++++++++++++++----
1 file changed, 40 insertions(+), 5 deletions(-)
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1291,6 +1291,9 @@ static int cx231xx_init_v4l2(struct cx23
uif = udev->actconfig->interface[idx];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
dev->video_mode.end_point_addr = uif->altsetting[0].endpoint[isoc_pipe].desc.bEndpointAddress;
dev->video_mode.num_alt = uif->num_altsetting;
@@ -1305,7 +1308,12 @@ static int cx231xx_init_v4l2(struct cx23
}
for (i = 0; i < dev->video_mode.num_alt; i++) {
- u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize);
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize);
dev->video_mode.alt_max_pkt_size[i] = (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
cx231xx_info("Alternate setting %i, max size= %i\n", i,
dev->video_mode.alt_max_pkt_size[i]);
@@ -1320,6 +1328,9 @@ static int cx231xx_init_v4l2(struct cx23
}
uif = udev->actconfig->interface[idx];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
dev->vbi_mode.end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].desc.
bEndpointAddress;
@@ -1337,8 +1348,12 @@ static int cx231xx_init_v4l2(struct cx23
}
for (i = 0; i < dev->vbi_mode.num_alt; i++) {
- u16 tmp =
- le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
desc.wMaxPacketSize);
dev->vbi_mode.alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
@@ -1356,6 +1371,9 @@ static int cx231xx_init_v4l2(struct cx23
}
uif = udev->actconfig->interface[idx];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
dev->sliced_cc_mode.end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].desc.
bEndpointAddress;
@@ -1372,7 +1390,12 @@ static int cx231xx_init_v4l2(struct cx23
}
for (i = 0; i < dev->sliced_cc_mode.num_alt; i++) {
- u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
desc.wMaxPacketSize);
dev->sliced_cc_mode.alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
@@ -1526,6 +1549,11 @@ static int cx231xx_usb_probe(struct usb_
}
uif = udev->actconfig->interface[idx];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) {
+ retval = -ENODEV;
+ goto err_video_alt;
+ }
+
dev->ts1_mode.end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].
desc.bEndpointAddress;
@@ -1543,7 +1571,14 @@ static int cx231xx_usb_probe(struct usb_
}
for (i = 0; i < dev->ts1_mode.num_alt; i++) {
- u16 tmp = le16_to_cpu(uif->altsetting[i].
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) {
+ retval = -ENODEV;
+ goto err_video_alt;
+ }
+
+ tmp = le16_to_cpu(uif->altsetting[i].
endpoint[isoc_pipe].desc.
wMaxPacketSize);
dev->ts1_mode.alt_max_pkt_size[i] =
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/cx231xx-audio-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/cx231xx-cards-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/gspca-konica-add-missing-endpoint-sanity-check.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/dib0700-fix-null-deref-at-probe.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* Patch "[media] dib0700: fix NULL-deref at probe" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: johan, gregkh, hans.verkuil, mchehab, mchehab; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] dib0700: fix NULL-deref at probe
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
dib0700-fix-null-deref-at-probe.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From d5823511c0f8719a39e72ede1bce65411ac653b7 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 13 Mar 2017 09:53:54 -0300
Subject: [media] dib0700: fix NULL-deref at probe
From: Johan Hovold <johan@kernel.org>
commit d5823511c0f8719a39e72ede1bce65411ac653b7 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.
Fixes: c4018fa2e4c0 ("[media] dib0700: fix RC support on Hauppauge
Nova-TD")
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb/dib0700_core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/usb/dvb-usb/dib0700_core.c
+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
@@ -786,6 +786,9 @@ int dib0700_rc_setup(struct dvb_usb_devi
/* Starting in firmware 1.20, the RC info is provided on a bulk pipe */
+ if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1)
+ return -ENODEV;
+
purb = usb_alloc_urb(0, GFP_KERNEL);
if (purb == NULL) {
err("rc usb alloc urb failed");
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/cx231xx-audio-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/cx231xx-cards-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/gspca-konica-add-missing-endpoint-sanity-check.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/dib0700-fix-null-deref-at-probe.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* Patch "[media] gspca: konica: add missing endpoint sanity check" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: johan, gregkh, hansverk, hdegoede, mchehab; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] gspca: konica: add missing endpoint sanity check
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
gspca-konica-add-missing-endpoint-sanity-check.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From aa58fedb8c7b6cf2f05941d238495f9e2f29655c Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 13 Mar 2017 09:53:59 -0300
Subject: [media] gspca: konica: add missing endpoint sanity check
From: Johan Hovold <johan@kernel.org>
commit aa58fedb8c7b6cf2f05941d238495f9e2f29655c upstream.
Make sure to check the number of endpoints to avoid accessing memory
beyond the endpoint array should a device lack the expected endpoints.
Note that, as far as I can tell, the gspca framework has already made
sure there is at least one endpoint in the current alternate setting so
there should be no risk for a NULL-pointer dereference here.
Fixes: b517af722860 ("V4L/DVB: gspca_konica: New gspca subdriver for
konica chipset using cams")
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/gspca/konica.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/usb/gspca/konica.c
+++ b/drivers/media/usb/gspca/konica.c
@@ -188,6 +188,9 @@ static int sd_start(struct gspca_dev *gs
return -EIO;
}
+ if (alt->desc.bNumEndpoints < 2)
+ return -ENODEV;
+
packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
n = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
Patches currently in stable-queue which might be from johan@kernel.org are
queue-3.18/cx231xx-audio-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-3.18/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-3.18/cx231xx-cards-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-3.18/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-3.18/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-3.18/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-3.18/gspca-konica-add-missing-endpoint-sanity-check.patch
queue-3.18/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-3.18/usb-serial-option-add-telit-me910-support.patch
queue-3.18/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-3.18/dib0700-fix-null-deref-at-probe.patch
queue-3.18/of-fdt-add-missing-allocation-failure-check.patch
queue-3.18/usbvision-fix-null-deref-at-probe.patch
queue-3.18/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-3.18/mceusb-fix-null-deref-at-probe.patch
queue-3.18/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-3.18/ath9k_htc-fix-null-deref-at-probe.patch
^ permalink raw reply
* Patch "ipx: call ipxitf_put() in ioctl error path" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: dan.carpenter, davem, gregkh, liqiang6-s; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
ipx: call ipxitf_put() in ioctl error path
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ipx-call-ipxitf_put-in-ioctl-error-path.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From ee0d8d8482345ff97a75a7d747efc309f13b0d80 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 2 May 2017 13:58:53 +0300
Subject: ipx: call ipxitf_put() in ioctl error path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Dan Carpenter <dan.carpenter@oracle.com>
commit ee0d8d8482345ff97a75a7d747efc309f13b0d80 upstream.
We should call ipxitf_put() if the copy_to_user() fails.
Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipx/af_ipx.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1168,11 +1168,10 @@ static int ipxitf_ioctl(unsigned int cmd
sipx->sipx_network = ipxif->if_netnum;
memcpy(sipx->sipx_node, ipxif->if_node,
sizeof(sipx->sipx_node));
- rc = -EFAULT;
+ rc = 0;
if (copy_to_user(arg, &ifr, sizeof(ifr)))
- break;
+ rc = -EFAULT;
ipxitf_put(ipxif);
- rc = 0;
break;
}
case SIOCAIPXITFCRT:
Patches currently in stable-queue which might be from dan.carpenter@oracle.com are
queue-3.18/ipx-call-ipxitf_put-in-ioctl-error-path.patch
^ permalink raw reply
* Patch "iio: proximity: as3935: fix as3935_write" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: matt.ranostay, george.mccollister, gregkh, jic23; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
iio: proximity: as3935: fix as3935_write
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
iio-proximity-as3935-fix-as3935_write.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 84ca8e364acb26aba3292bc113ca8ed4335380fd Mon Sep 17 00:00:00 2001
From: Matt Ranostay <matt.ranostay@konsulko.com>
Date: Thu, 13 Apr 2017 23:21:56 -0700
Subject: iio: proximity: as3935: fix as3935_write
From: Matt Ranostay <matt.ranostay@konsulko.com>
commit 84ca8e364acb26aba3292bc113ca8ed4335380fd upstream.
AS3935_WRITE_DATA macro bit is incorrect and the actual write
sequence is two leading zeros.
Cc: George McCollister <george.mccollister@gmail.com>
Signed-off-by: Matt Ranostay <matt.ranostay@konsulko.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/proximity/as3935.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -50,7 +50,6 @@
#define AS3935_TUNE_CAP 0x08
#define AS3935_CALIBRATE 0x3D
-#define AS3935_WRITE_DATA BIT(15)
#define AS3935_READ_DATA BIT(14)
#define AS3935_ADDRESS(x) ((x) << 8)
@@ -103,7 +102,7 @@ static int as3935_write(struct as3935_st
{
u8 *buf = st->buf;
- buf[0] = (AS3935_WRITE_DATA | AS3935_ADDRESS(reg)) >> 8;
+ buf[0] = AS3935_ADDRESS(reg) >> 8;
buf[1] = val;
return spi_write(st->spi, buf, 2);
Patches currently in stable-queue which might be from matt.ranostay@konsulko.com are
queue-3.18/iio-proximity-as3935-fix-as3935_write.patch
^ permalink raw reply
* Patch "[media] s5p-mfc: Fix unbalanced call to clock management" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: m.szyprowski, gregkh, mchehab, s.nawrocki; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] s5p-mfc: Fix unbalanced call to clock management
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
s5p-mfc-fix-unbalanced-call-to-clock-management.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From a5cb00eb4223458250b55daf03ac7ea5f424d601 Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Wed, 22 Mar 2017 04:53:57 -0300
Subject: [media] s5p-mfc: Fix unbalanced call to clock management
From: Marek Szyprowski <m.szyprowski@samsung.com>
commit a5cb00eb4223458250b55daf03ac7ea5f424d601 upstream.
Clock should be turned off after calling s5p_mfc_init_hw() from the
watchdog worker, like it is already done in the s5p_mfc_open() which also
calls this function.
Fixes: af93574678108 ("[media] MFC: Add MFC 5.1 V4L2 driver")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/s5p-mfc/s5p_mfc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -169,6 +169,7 @@ static void s5p_mfc_watchdog_worker(stru
}
s5p_mfc_clock_on();
ret = s5p_mfc_init_hw(dev);
+ s5p_mfc_clock_off();
if (ret)
mfc_err("Failed to reinit FW\n");
}
Patches currently in stable-queue which might be from m.szyprowski@samsung.com are
queue-3.18/s5p-mfc-fix-unbalanced-call-to-clock-management.patch
^ permalink raw reply
* Patch "[media] zr364xx: enforce minimum size when reading header" has been added to the 3.18-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: amilburn, gregkh, mchehab; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] zr364xx: enforce minimum size when reading header
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
zr364xx-enforce-minimum-size-when-reading-header.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From ee0fe833d96793853335844b6d99fb76bd12cbeb Mon Sep 17 00:00:00 2001
From: Alyssa Milburn <amilburn@zall.org>
Date: Sat, 1 Apr 2017 14:34:08 -0300
Subject: [media] zr364xx: enforce minimum size when reading header
From: Alyssa Milburn <amilburn@zall.org>
commit ee0fe833d96793853335844b6d99fb76bd12cbeb upstream.
This code copies actual_length-128 bytes from the header, which will
underflow if the received buffer is too small.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/zr364xx/zr364xx.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/media/usb/zr364xx/zr364xx.c
+++ b/drivers/media/usb/zr364xx/zr364xx.c
@@ -605,6 +605,14 @@ static int zr364xx_read_video_callback(s
ptr = pdest = frm->lpvbits;
if (frm->ulState == ZR364XX_READ_IDLE) {
+ if (purb->actual_length < 128) {
+ /* header incomplete */
+ dev_info(&cam->udev->dev,
+ "%s: buffer (%d bytes) too small to hold jpeg header. Discarding.\n",
+ __func__, purb->actual_length);
+ return -EINVAL;
+ }
+
frm->ulState = ZR364XX_READ_FRAME;
frm->cur_size = 0;
Patches currently in stable-queue which might be from amilburn@zall.org are
queue-3.18/ttusb2-limit-messages-to-buffer-size.patch
queue-3.18/zr364xx-enforce-minimum-size-when-reading-header.patch
^ permalink raw reply
* Patch "[media] cx231xx-audio: fix init error path" has been added to the 4.11-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: johan, Srinivasa.Deevi, gregkh, hans.verkuil, mchehab
Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] cx231xx-audio: fix init error path
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
cx231xx-audio-fix-init-error-path.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From fff1abc4d54e469140a699612b4db8d6397bfcba Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 13 Mar 2017 09:53:57 -0300
Subject: [media] cx231xx-audio: fix init error path
From: Johan Hovold <johan@kernel.org>
commit fff1abc4d54e469140a699612b4db8d6397bfcba upstream.
Make sure to release the snd_card also on a late allocation error.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cx231xx/cx231xx-audio.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -670,10 +670,8 @@ static int cx231xx_audio_init(struct cx2
spin_lock_init(&adev->slock);
err = snd_pcm_new(card, "Cx231xx Audio", 0, 0, 1, &pcm);
- if (err < 0) {
- snd_card_free(card);
- return err;
- }
+ if (err < 0)
+ goto err_free_card;
snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE,
&snd_cx231xx_pcm_capture);
@@ -687,10 +685,9 @@ static int cx231xx_audio_init(struct cx2
INIT_WORK(&dev->wq_trigger, audio_trigger);
err = snd_card_register(card);
- if (err < 0) {
- snd_card_free(card);
- return err;
- }
+ if (err < 0)
+ goto err_free_card;
+
adev->sndcard = card;
adev->udev = dev->udev;
@@ -709,9 +706,10 @@ static int cx231xx_audio_init(struct cx2
"audio EndPoint Addr 0x%x, Alternate settings: %i\n",
adev->end_point_addr, adev->num_alt);
adev->alt_max_pkt_size = kmalloc(32 * adev->num_alt, GFP_KERNEL);
-
- if (adev->alt_max_pkt_size == NULL)
- return -ENOMEM;
+ if (!adev->alt_max_pkt_size) {
+ err = -ENOMEM;
+ goto err_free_card;
+ }
for (i = 0; i < adev->num_alt; i++) {
u16 tmp =
@@ -725,6 +723,11 @@ static int cx231xx_audio_init(struct cx2
}
return 0;
+
+err_free_card:
+ snd_card_free(card);
+
+ return err;
}
static int cx231xx_audio_fini(struct cx231xx *dev)
Patches currently in stable-queue which might be from johan@kernel.org are
queue-4.11/cx231xx-audio-fix-null-deref-at-probe.patch
queue-4.11/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-4.11/usb-chaoskey-fix-alea-quirk-on-big-endian-hosts.patch
queue-4.11/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-4.11/cx231xx-cards-fix-null-deref-at-probe.patch
queue-4.11/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-4.11/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-4.11/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-4.11/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-4.11/gspca-konica-add-missing-endpoint-sanity-check.patch
queue-4.11/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-4.11/usb-serial-option-add-telit-me910-support.patch
queue-4.11/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-4.11/dib0700-fix-null-deref-at-probe.patch
queue-4.11/cx231xx-audio-fix-init-error-path.patch
queue-4.11/of-fdt-add-missing-allocation-failure-check.patch
queue-4.11/usbvision-fix-null-deref-at-probe.patch
queue-4.11/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-4.11/mceusb-fix-null-deref-at-probe.patch
queue-4.11/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-4.11/ath9k_htc-fix-null-deref-at-probe.patch
queue-4.11/usb-musb-fix-trying-to-suspend-while-active-for-otg-configurations.patch
^ permalink raw reply
* Patch "[media] cx231xx-audio: fix NULL-deref at probe" has been added to the 4.11-stable tree
From: gregkh @ 2017-05-23 13:40 UTC (permalink / raw)
To: johan, Srinivasa.Deevi, gregkh, hans.verkuil, mchehab
Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
[media] cx231xx-audio: fix NULL-deref at probe
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
cx231xx-audio-fix-null-deref-at-probe.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 65f921647f4c89a2068478c89691f39b309b58f7 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 13 Mar 2017 09:53:58 -0300
Subject: [media] cx231xx-audio: fix NULL-deref at probe
From: Johan Hovold <johan@kernel.org>
commit 65f921647f4c89a2068478c89691f39b309b58f7 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cx231xx/cx231xx-audio.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -697,6 +697,11 @@ static int cx231xx_audio_init(struct cx2
hs_config_info[0].interface_info.
audio_index + 1];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) {
+ err = -ENODEV;
+ goto err_free_card;
+ }
+
adev->end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].desc.
bEndpointAddress;
@@ -712,8 +717,14 @@ static int cx231xx_audio_init(struct cx2
}
for (i = 0; i < adev->num_alt; i++) {
- u16 tmp =
- le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) {
+ err = -ENODEV;
+ goto err_free_pkt_size;
+ }
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
wMaxPacketSize);
adev->alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
@@ -724,6 +735,8 @@ static int cx231xx_audio_init(struct cx2
return 0;
+err_free_pkt_size:
+ kfree(adev->alt_max_pkt_size);
err_free_card:
snd_card_free(card);
Patches currently in stable-queue which might be from johan@kernel.org are
queue-4.11/cx231xx-audio-fix-null-deref-at-probe.patch
queue-4.11/usb-serial-io_ti-fix-div-by-zero-in-set_termios.patch
queue-4.11/usb-chaoskey-fix-alea-quirk-on-big-endian-hosts.patch
queue-4.11/usb-hub-fix-non-ss-hub-descriptor-handling.patch
queue-4.11/cx231xx-cards-fix-null-deref-at-probe.patch
queue-4.11/usb-serial-ftdi_sio-add-olimex-arm-usb-tiny-h-pids.patch
queue-4.11/usb-serial-ftdi_sio-fix-setting-latency-for-unprivileged-users.patch
queue-4.11/usb-iowarrior-fix-info-ioctl-on-big-endian-hosts.patch
queue-4.11/watchdog-pcwd_usb-fix-null-deref-at-probe.patch
queue-4.11/gspca-konica-add-missing-endpoint-sanity-check.patch
queue-4.11/usb-serial-qcserial-add-more-lenovo-em74xx-device-ids.patch
queue-4.11/usb-serial-option-add-telit-me910-support.patch
queue-4.11/net-irda-irda-usb-fix-firmware-name-on-big-endian-hosts.patch
queue-4.11/dib0700-fix-null-deref-at-probe.patch
queue-4.11/cx231xx-audio-fix-init-error-path.patch
queue-4.11/of-fdt-add-missing-allocation-failure-check.patch
queue-4.11/usbvision-fix-null-deref-at-probe.patch
queue-4.11/usb-serial-mct_u232-fix-big-endian-baud-rate-handling.patch
queue-4.11/mceusb-fix-null-deref-at-probe.patch
queue-4.11/usb-hub-fix-ss-hub-descriptor-handling.patch
queue-4.11/ath9k_htc-fix-null-deref-at-probe.patch
queue-4.11/usb-musb-fix-trying-to-suspend-while-active-for-otg-configurations.patch
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox