4.9-stable patches

added patches:
	net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch

diff --git a/queue-4.9/net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch b/queue-4.9/net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch
new file mode 100644 (file)
index 0000000..ba9cf91
--- /dev/null
+++ b/queue-4.9/net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch
@@ -0,0 +1,35 @@
+From a56dcc6b455830776899ce3686735f1172e12243 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 13 Nov 2019 21:28:31 +0300
+Subject: net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit a56dcc6b455830776899ce3686735f1172e12243 upstream.
+
+This code is supposed to test for negative error codes and partial
+reads, but because sizeof() is size_t (unsigned) type then negative
+error codes are type promoted to high positive values and the condition
+doesn't work as expected.
+
+Fixes: 332f989a3b00 ("CDC-NCM: handle incomplete transfer of MTU")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/cdc_ncm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -577,7 +577,7 @@ static void cdc_ncm_set_dgram_size(struc
+       err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE,
+                             USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
+                             0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
+-      if (err < sizeof(max_datagram_size)) {
++      if (err != sizeof(max_datagram_size)) {
+               dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n");
+               goto out;
+       }

diff --git a/queue-4.9/series b/queue-4.9/series
index 9adddeb47c79d02a1b227990660c5397aee1b8f4..fff5ff10b251849241f4f58531e2a98e18fd17e2 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -145,3 +145,4 @@ fuse-use-read_once-on-congestion_threshold-and-max_b.patch
 ib-iser-fix-possible-null-deref-at-iser_inv_desc.patch
 memfd-use-radix_tree_deref_slot_protected-to-avoid-the-warning.patch
 slcan-fix-memory-leak-in-error-path.patch
+net-cdc_ncm-signedness-bug-in-cdc_ncm_set_dgram_size.patch