fixes for 4.4

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.4/series b/queue-4.4/series
index c6d9cdf6634aceda7788baede1bed6862fbe1382..c7884ee8a9be4a187ee1a438e0b7c6e35e2703ad 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -19,3 +19,4 @@ fs-ocfs2-fix-a-possible-null-pointer-dereference-in-.patch
 mips-fw-sni-fix-out-of-bounds-init-of-o32-stack.patch
 nfsv4-fix-leak-of-clp-cl_acceptor-string.patch
 tracing-initialize-iter-seq-after-zeroing-in-tracing.patch
+usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch

diff --git a/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch b/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch
new file mode 100644 (file)
index 0000000..4b3a061
--- /dev/null
+++ b/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch
@@ -0,0 +1,39 @@
+From beea3ba2e329e5f30ecb64bc81f0e008cd450f4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 17:11:15 +0300
+Subject: USB: legousbtower: fix a signedness bug in tower_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit fd47a417e75e2506eb3672ae569b1c87e3774155 ]
+
+The problem is that sizeof() is unsigned long so negative error codes
+are type promoted to high positive values and the condition becomes
+false.
+
+Fixes: 1d427be4a39d ("USB: legousbtower: fix slab info leak at probe")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191011141115.GA4521@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/legousbtower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 32b41eb07f00e..8350ecfbcf21a 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -910,7 +910,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+                                 get_version_reply,
+                                 sizeof(*get_version_reply),
+                                 1000);
+-      if (result < sizeof(*get_version_reply)) {
++      if (result != sizeof(*get_version_reply)) {
+               if (result >= 0)
+                       result = -EIO;
+               dev_err(idev, "get version request failed: %d\n", result);
+-- 
+2.20.1
+