releases/4.9.28/usb-serial-ssu100-fix-control-message-error-handling.patch

   1 From 1eac5c244f705182d1552a53e2f74e2775ed95d6 Mon Sep 17 00:00:00 2001
   2 From: Johan Hovold <johan@kernel.org>
   3 Date: Thu, 12 Jan 2017 14:56:22 +0100
   4 Subject: USB: serial: ssu100: fix control-message error handling
   5
   6 From: Johan Hovold <johan@kernel.org>
   7
   8 commit 1eac5c244f705182d1552a53e2f74e2775ed95d6 upstream.
   9
  10 Make sure to detect short control-message transfers rather than continue
  11 with zero-initialised data when retrieving modem status and during
  12 device initialisation.
  13
  14 Fixes: 52af95459939 ("USB: add USB serial ssu100 driver")
  15 Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  16 Signed-off-by: Johan Hovold <johan@kernel.org>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18
  19 ---
  20  drivers/usb/serial/ssu100.c |   31 ++++++++++++++++++++++++-------
  21  1 file changed, 24 insertions(+), 7 deletions(-)
  22
  23 --- a/drivers/usb/serial/ssu100.c
  24 +++ b/drivers/usb/serial/ssu100.c
  25 @@ -80,9 +80,17 @@ static inline int ssu100_setdevice(struc
  26
  27  static inline int ssu100_getdevice(struct usb_device *dev, u8 *data)
  28  {
  29 -       return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
  30 -                              QT_SET_GET_DEVICE, 0xc0, 0, 0,
  31 -                              data, 3, 300);
  32 +       int ret;
  33 +
  34 +       ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
  35 +                             QT_SET_GET_DEVICE, 0xc0, 0, 0,
  36 +                             data, 3, 300);
  37 +       if (ret < 3) {
  38 +               if (ret >= 0)
  39 +                       ret = -EIO;
  40 +       }
  41 +
  42 +       return ret;
  43  }
  44
  45  static inline int ssu100_getregister(struct usb_device *dev,
  46 @@ -90,10 +98,17 @@ static inline int ssu100_getregister(str
  47                                      unsigned short reg,
  48                                      u8 *data)
  49  {
  50 -       return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
  51 -                              QT_SET_GET_REGISTER, 0xc0, reg,
  52 -                              uart, data, sizeof(*data), 300);
  53 +       int ret;
  54
  55 +       ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
  56 +                             QT_SET_GET_REGISTER, 0xc0, reg,
  57 +                             uart, data, sizeof(*data), 300);
  58 +       if (ret < sizeof(*data)) {
  59 +               if (ret >= 0)
  60 +                       ret = -EIO;
  61 +       }
  62 +
  63 +       return ret;
  64  }
  65
  66
  67 @@ -289,8 +304,10 @@ static int ssu100_open(struct tty_struct
  68                                  QT_OPEN_CLOSE_CHANNEL,
  69                                  QT_TRANSFER_IN, 0x01,
  70                                  0, data, 2, 300);
  71 -       if (result < 0) {
  72 +       if (result < 2) {
  73                 dev_dbg(&port->dev, "%s - open failed %i\n", __func__, result);
  74 +               if (result >= 0)
  75 +                       result = -EIO;
  76                 kfree(data);
  77                 return result;
  78         }