fixes for 4.9

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.9/series b/queue-4.9/series
index d0e8263efebec934a35ba0b7a094968d482cc6ac..1dfc4594ee2469434b8df0df087110f542dc39cc 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -28,3 +28,4 @@ mips-fw-sni-fix-out-of-bounds-init-of-o32-stack.patch
 nfsv4-fix-leak-of-clp-cl_acceptor-string.patch
 s390-uaccess-avoid-false-positive-compiler-warnings.patch
 tracing-initialize-iter-seq-after-zeroing-in-tracing.patch
+usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch

diff --git a/queue-4.9/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch b/queue-4.9/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch
new file mode 100644 (file)
index 0000000..7b2f97a
--- /dev/null
+++ b/queue-4.9/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch
@@ -0,0 +1,39 @@
+From 164a0a0e21a82d813e9486119a5b492330f801d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 17:11:15 +0300
+Subject: USB: legousbtower: fix a signedness bug in tower_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit fd47a417e75e2506eb3672ae569b1c87e3774155 ]
+
+The problem is that sizeof() is unsigned long so negative error codes
+are type promoted to high positive values and the condition becomes
+false.
+
+Fixes: 1d427be4a39d ("USB: legousbtower: fix slab info leak at probe")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191011141115.GA4521@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/legousbtower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index f56307059d48c..7cac3ee09b09d 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -898,7 +898,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+                                 get_version_reply,
+                                 sizeof(*get_version_reply),
+                                 1000);
+-      if (result < sizeof(*get_version_reply)) {
++      if (result != sizeof(*get_version_reply)) {
+               if (result >= 0)
+                       result = -EIO;
+               dev_err(idev, "get version request failed: %d\n", result);
+-- 
+2.20.1
+