github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

USB serial fixes for 7.2-rc4

Browse Source 
Here are some fixes for 7.2:
 
  - fix data loss on keyspan_pda throttle
  - fix memory corruption with malicious edgeport devices
  - fix memory corruption with corrupt io_ti firmware
  - fix OOB read with corrupt mxuport firmware
 
 Included are also some new ftdi and modem device ids.
 
 All have been in linux-next with no reported issues.
 -----BEGIN PGP SIGNATURE-----
 
 iJEEABYKADkWIQQHbPq+cpGvN/peuzMLxc3C7H1lCAUCamNNlhsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDIACgkQC8XNwux9ZQgZ/gEAgK5keVsvCTAuDjg9cvyu
 zBSPRaAEK82JEQNQqvM/8DABAOE+5B4Czqz0sqNefMj88i1MO9hN0+eyp8gkzO8h
 mcAN
 =pG38
 -----END PGP SIGNATURE-----

Merge tag 'usb-serial-7.2-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB serial fixes for 7.2-rc4

Here are some fixes for 7.2:

 - fix data loss on keyspan_pda throttle
 - fix memory corruption with malicious edgeport devices
 - fix memory corruption with corrupt io_ti firmware
 - fix OOB read with corrupt mxuport firmware

Included are also some new ftdi and modem device ids.

All have been in linux-next with no reported issues.

* tag 'usb-serial-7.2-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:
  USB: serial: io_edgeport: cap received transmit credits
  USB: serial: option: add TDTECH MT5710-CN
  USB: serial: io_ti: reject oversized boot-mode firmware
  USB: serial: mxuport: validate firmware header size
  USB: serial: ftdi_sio: add support for E+H FXA291
  USB: serial: keyspan_pda: fix data loss on receive throttling
This commit is contained in:
Greg Kroah-Hartman 2026-07-24 15:36:52 +02:00
commit b6061b6cca
7 changed files with 58 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/usb/serial/ftdi_sio.c
View File

@ -1072,6 +1072,8 @@ static const struct usb_device_id id_table_combined[] = {
{ USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) },
/* Abacus Electrics */
{ USB_DEVICE(FTDI_VID, ABACUS_OPTICAL_PROBE_PID) },
/* Endress+Hauser AG devices */
{ USB_DEVICE(FTDI_VID, FTDI_EH_FXA291_PID) },
{ } /* Terminating entry */
};

5
drivers/usb/serial/ftdi_sio_ids.h
View File

@ -313,6 +313,11 @@
#define FTDI_ELV_UDF77_PID 0xFB5E /* USB DCF Funkuhr (UDF 77) */
#define FTDI_ELV_UIO88_PID 0xFB5F /* USB-I/O Interface (UIO 88) */
/*
* Endress+Hauser AG product ids (FTDI_VID)
*/
#define FTDI_EH_FXA291_PID 0xE510
/*
* EVER Eco Pro UPS (http://www.ever.com.pl/)
*/

3
drivers/usb/serial/io_edgeport.c
View File

@ -646,7 +646,8 @@ static void edge_interrupt_callback(struct urb *urb)
if (edge_port && edge_port->open) {
spin_lock_irqsave(&edge_port->ep_lock,
flags);
edge_port->txCredits += txCredits;
edge_port->txCredits = min(edge_port->txCredits + txCredits,
edge_port->maxTxCredits);
spin_unlock_irqrestore(&edge_port->ep_lock,
flags);
dev_dbg(dev, "%s - txcredits for port%d = %d\n",

6
drivers/usb/serial/io_ti.c
View File

@ -1464,6 +1464,12 @@ static int do_boot_mode(struct edgeport_serial *serial,
/* Allocate a 15.5k buffer + 3 byte header */
buffer_size = (((1024 * 16) - 512) +
sizeof(struct ti_i2c_image_header));
if (fw->size - 4 > buffer_size) {
dev_err(dev, "%s - firmware image is too large\n",
__func__);
return -EINVAL;
}
buffer = kmalloc(buffer_size, GFP_KERNEL);
if (!buffer)
return -ENOMEM;

44
drivers/usb/serial/keyspan_pda.c
View File

@ -33,6 +33,8 @@ struct keyspan_pda_private {
struct work_struct unthrottle_work;
struct usb_serial *serial;
struct usb_serial_port *port;
bool throttled;
bool throttle_req;
};
static int keyspan_pda_write_start(struct usb_serial_port *port);
@ -148,6 +150,7 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
int retval;
int status = urb->status;
struct keyspan_pda_private *priv;
bool throttled = false;
unsigned long flags;
priv = usb_get_serial_port_data(port);
@ -209,16 +212,24 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
}
exit:
retval = usb_submit_urb(urb, GFP_ATOMIC);
if (retval)
dev_err(&port->dev,
"%s - usb_submit_urb failed with result %d\n",
__func__, retval);
spin_lock_irqsave(&port->lock, flags);
if (priv->throttle_req) {
priv->throttled = true;
throttled = true;
}
spin_unlock_irqrestore(&port->lock, flags);
if (!throttled) {
retval = usb_submit_urb(urb, GFP_ATOMIC);
if (retval)
dev_err(&port->dev, "failed to resubmit in urb: %d\n", retval);
}
}
static void keyspan_pda_rx_throttle(struct tty_struct *tty)
{
struct usb_serial_port *port = tty->driver_data;
struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
/*
* Stop receiving characters. We just turn off the URB request, and
@ -228,16 +239,29 @@ static void keyspan_pda_rx_throttle(struct tty_struct *tty)
* send an XOFF, although it might make sense to foist that off upon
* the device too.
*/
usb_kill_urb(port->interrupt_in_urb);
spin_lock_irq(&port->lock);
priv->throttle_req = true;
spin_unlock_irq(&port->lock);
}
static void keyspan_pda_rx_unthrottle(struct tty_struct *tty)
{
struct usb_serial_port *port = tty->driver_data;
struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
bool throttled;
int ret;
/* just restart the receive interrupt URB */
if (usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL))
dev_dbg(&port->dev, "usb_submit_urb(read urb) failed\n");
spin_lock_irq(&port->lock);
throttled = priv->throttled;
priv->throttled = false;
priv->throttle_req = false;
spin_unlock_irq(&port->lock);
if (throttled) {
ret = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
if (ret)
dev_err(&port->dev, "failed to submit in urb: %d\n", ret);
}
}
static speed_t keyspan_pda_setbaud(struct usb_serial *serial, speed_t baud)
@ -577,6 +601,8 @@ static int keyspan_pda_open(struct tty_struct *tty,
spin_lock_irq(&port->lock);
priv->tx_room = rc;
priv->throttled = false;
priv->throttle_req = false;
spin_unlock_irq(&port->lock);
rc = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);

7
drivers/usb/serial/mxuport.c
View File

@ -1080,6 +1080,13 @@ static int mxuport_probe(struct usb_serial *serial,
/* Use the firmware already in the device */
err = 0;
} else {
if (fw_p->size <= VER_ADDR_3) {
dev_err(&serial->interface->dev,
"Firmware %s is too short\n", buf);
err = -EINVAL;
goto out;
}
local_ver = ((fw_p->data[VER_ADDR_1] << 16) |
(fw_p->data[VER_ADDR_2] << 8) |
fw_p->data[VER_ADDR_3]);

1
drivers/usb/serial/option.c
View File

@ -2496,6 +2496,7 @@ static const struct usb_device_id option_ids[] = {
.driver_info = RSVD(5) },
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x1003, 0xff), /* Rolling RW135R-GL (laptop MBIM) */
.driver_info = RSVD(5) },
{ USB_DEVICE_INTERFACE_CLASS(0x3466, 0x3301, 0xff) }, /* TDTECH MT5710-CN */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) },