Received: by 2002:a05:6a10:206:0:0:0:0 with SMTP id 6csp2643606pxj; Mon, 14 Jun 2021 03:52:33 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwcnn3gskdwnIAIEnVfk7byA/ghBcFM2iusqybrE6TkY7N4sg10nFtCT8qE3DaGFoIFlKqR X-Received: by 2002:a17:906:b191:: with SMTP id w17mr15068164ejy.10.1623667953330; Mon, 14 Jun 2021 03:52:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1623667953; cv=none; d=google.com; s=arc-20160816; b=isnDRb/UJJpnO/HCYNbYQAHD5Fgq5X+EeHlytBZQj0Q3QiA3lQ9lHOfnxjlF8Hc56Y fxxDfgHYnZrbmqrvVwnQOBg9PaRRIxRstzQQyNC/30S8TBgRSe8tqfobvX3f6Nxdz3Vw QDaGXYLgGJ0EnrKHCubtUmFt2qNbyPPS0VOvC3o6HXwYXM+Udhy0GwLPUmaoopBo9wVQ wQFRvqimF1SbvQYiV1QuvVfTVU38eH5MQPW3gQIIW82UQAoaTSdmD60ioHc7J9pmiAqg n5f0yz+d5oWTt+iFyd6OrIChfMNzJaKQvq/4IsMh7fBkIzQbJgGhNZztnCCTPKShcs/d j25w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=gIxt/3gSj7qQtnNryHQIVkzHJkYQCvxSdtnKyo8UpeM=; b=Yinbk6iorA0zfh8Yy/VzEwaCptKvhObGvms2Mj8pbSaRIGaRf2jzFLGVLjhfLVEHD4 lDNJCRsgPQ0SzjZoZlJZv9M7zTDVl9vt4xfEbJwWHdxUtZtOTxyqK3eUAAYcBUgSxftY QTKdQsuLPHqsmSg9P0Rhl1+gpMC87iOqjTHe4EAYM7X6ggAzxVquGtLy3WMLdQdLi1sG u2rmGzjnpjA3teo+i2mdqkdePYHiI5rcxSb5SmLv+fbeMaOYCxdAmLiU3aCO1vG5SHBZ hZfAF3mMF/MgqzxsgtGEwJTBNcNf2jsBoE1AOURPrBXjXjv1vY5naifpwHmAacZnJe/O Zm7A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2IvG5WOK; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id d4si11187279ejo.252.2021.06.14.03.52.10; Mon, 14 Jun 2021 03:52:33 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2IvG5WOK; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234242AbhFNKu6 (ORCPT + 99 others); Mon, 14 Jun 2021 06:50:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:50290 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234076AbhFNKnx (ORCPT ); Mon, 14 Jun 2021 06:43:53 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id EBA166143A; Mon, 14 Jun 2021 10:36:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623666966; bh=AcXyFvkwlsC4GaaYcoqaYqJinasl6uD/dU1qPWauWYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2IvG5WOKnqLR/cZZNXelgYZ9Aa/aS5MbCxIssY+lVU8XlSUpa0QITqH51zAi2I0vA 522LNcmNd7TiL3lOVDI5ehUXcMpPWwEaqozR+Cu3vjLPWi8D5EtlbfMhJX1RH5W87B NAGEYuKjC1lgUHNNVYuYc+V8pKXS+5nXXVVDeQI0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Felipe Balbi , "Gustavo A. R. Silva" , Lorenzo Colitti , "Martin K. Petersen" , Michael R Sweet , Mike Christie , Pawel Laszczak , Peter Chen , Sudhakar Panneerselvam , Wei Ming Chen , Will McVicker , Zqiang , =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Subject: [PATCH 4.19 47/67] usb: fix various gadgets null ptr deref on 10gbps cabling. Date: Mon, 14 Jun 2021 12:27:30 +0200 Message-Id: <20210614102645.377303131@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210614102643.797691914@linuxfoundation.org> References: <20210614102643.797691914@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Maciej Żenczykowski commit 90c4d05780d47e14a50e11a7f17373104cd47d25 upstream. This avoids a null pointer dereference in f_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm} by simply reusing the 5gbps config for 10gbps. Fixes: eaef50c76057 ("usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus") Cc: Christophe JAILLET Cc: Felipe Balbi Cc: Gustavo A. R. Silva Cc: Lorenzo Colitti Cc: Martin K. Petersen Cc: Michael R Sweet Cc: Mike Christie Cc: Pawel Laszczak Cc: Peter Chen Cc: Sudhakar Panneerselvam Cc: Wei Ming Chen Cc: Will McVicker Cc: Zqiang Reviewed-By: Lorenzo Colitti Cc: stable Signed-off-by: Maciej Żenczykowski Link: https://lore.kernel.org/r/20210608044141.3898496-1-zenczykowski@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_ecm.c | 2 +- drivers/usb/gadget/function/f_eem.c | 2 +- drivers/usb/gadget/function/f_hid.c | 3 ++- drivers/usb/gadget/function/f_loopback.c | 2 +- drivers/usb/gadget/function/f_printer.c | 3 ++- drivers/usb/gadget/function/f_rndis.c | 2 +- drivers/usb/gadget/function/f_serial.c | 2 +- drivers/usb/gadget/function/f_sourcesink.c | 3 ++- drivers/usb/gadget/function/f_subset.c | 2 +- drivers/usb/gadget/function/f_tcm.c | 3 ++- 10 files changed, 14 insertions(+), 10 deletions(-) --- a/drivers/usb/gadget/function/f_ecm.c +++ b/drivers/usb/gadget/function/f_ecm.c @@ -791,7 +791,7 @@ ecm_bind(struct usb_configuration *c, st fs_ecm_notify_desc.bEndpointAddress; status = usb_assign_descriptors(f, ecm_fs_function, ecm_hs_function, - ecm_ss_function, NULL); + ecm_ss_function, ecm_ss_function); if (status) goto fail; --- a/drivers/usb/gadget/function/f_eem.c +++ b/drivers/usb/gadget/function/f_eem.c @@ -305,7 +305,7 @@ static int eem_bind(struct usb_configura eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress; status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function, - eem_ss_function, NULL); + eem_ss_function, eem_ss_function); if (status) goto fail; --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -808,7 +808,8 @@ static int hidg_bind(struct usb_configur hidg_fs_out_ep_desc.bEndpointAddress; status = usb_assign_descriptors(f, hidg_fs_descriptors, - hidg_hs_descriptors, hidg_ss_descriptors, NULL); + hidg_hs_descriptors, hidg_ss_descriptors, + hidg_ss_descriptors); if (status) goto fail; --- a/drivers/usb/gadget/function/f_loopback.c +++ b/drivers/usb/gadget/function/f_loopback.c @@ -207,7 +207,7 @@ autoconf_fail: ss_loop_sink_desc.bEndpointAddress = fs_loop_sink_desc.bEndpointAddress; ret = usb_assign_descriptors(f, fs_loopback_descs, hs_loopback_descs, - ss_loopback_descs, NULL); + ss_loopback_descs, ss_loopback_descs); if (ret) return ret; --- a/drivers/usb/gadget/function/f_printer.c +++ b/drivers/usb/gadget/function/f_printer.c @@ -1063,7 +1063,8 @@ autoconf_fail: ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress; ret = usb_assign_descriptors(f, fs_printer_function, - hs_printer_function, ss_printer_function, NULL); + hs_printer_function, ss_printer_function, + ss_printer_function); if (ret) return ret; --- a/drivers/usb/gadget/function/f_rndis.c +++ b/drivers/usb/gadget/function/f_rndis.c @@ -789,7 +789,7 @@ rndis_bind(struct usb_configuration *c, ss_notify_desc.bEndpointAddress = fs_notify_desc.bEndpointAddress; status = usb_assign_descriptors(f, eth_fs_function, eth_hs_function, - eth_ss_function, NULL); + eth_ss_function, eth_ss_function); if (status) goto fail; --- a/drivers/usb/gadget/function/f_serial.c +++ b/drivers/usb/gadget/function/f_serial.c @@ -233,7 +233,7 @@ static int gser_bind(struct usb_configur gser_ss_out_desc.bEndpointAddress = gser_fs_out_desc.bEndpointAddress; status = usb_assign_descriptors(f, gser_fs_function, gser_hs_function, - gser_ss_function, NULL); + gser_ss_function, gser_ss_function); if (status) goto fail; dev_dbg(&cdev->gadget->dev, "generic ttyGS%d: %s speed IN/%s OUT/%s\n", --- a/drivers/usb/gadget/function/f_sourcesink.c +++ b/drivers/usb/gadget/function/f_sourcesink.c @@ -431,7 +431,8 @@ no_iso: ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress; ret = usb_assign_descriptors(f, fs_source_sink_descs, - hs_source_sink_descs, ss_source_sink_descs, NULL); + hs_source_sink_descs, ss_source_sink_descs, + ss_source_sink_descs); if (ret) return ret; --- a/drivers/usb/gadget/function/f_subset.c +++ b/drivers/usb/gadget/function/f_subset.c @@ -358,7 +358,7 @@ geth_bind(struct usb_configuration *c, s fs_subset_out_desc.bEndpointAddress; status = usb_assign_descriptors(f, fs_eth_function, hs_eth_function, - ss_eth_function, NULL); + ss_eth_function, ss_eth_function); if (status) goto fail; --- a/drivers/usb/gadget/function/f_tcm.c +++ b/drivers/usb/gadget/function/f_tcm.c @@ -2071,7 +2071,8 @@ static int tcm_bind(struct usb_configura uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress; ret = usb_assign_descriptors(f, uasp_fs_function_desc, - uasp_hs_function_desc, uasp_ss_function_desc, NULL); + uasp_hs_function_desc, uasp_ss_function_desc, + uasp_ss_function_desc); if (ret) goto ep_fail;