Unverified Commit e3b0e543 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5791 usb: hub: Guard against accesses to uninitialized BOS descriptors 

Merge Pull Request from: @ci-robot 
 
PR sync from: Jinjiang Tu <tujinjiang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/AT5LJUWWBFULKID23NQVACPAE5I5TKWM/ 
 
https://gitee.com/src-openeuler/kernel/issues/I94P5J 
 
Link:https://gitee.com/openeuler/kernel/pulls/5791

 

Reviewed-by: default avatarKefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents cc780bd7 9f654e5f

drivers/usb/core/hub.c

+24 −4
Original line number Diff line number Diff line
@@ -146,6 +146,10 @@ int usb_device_supports_lpm(struct usb_device *udev) 
	if (udev->quirks & USB_QUIRK_NO_LPM)

		return 0;



	/* Skip if the device BOS descriptor couldn't be read */

	if (!udev->bos)

		return 0;



	/* USB 2.1 (and greater) devices indicate LPM support through

	 * their USB 2.0 Extended Capabilities BOS descriptor.

	 */
@@ -322,6 +326,10 @@ static void usb_set_lpm_parameters(struct usb_device *udev) 
	if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER)

		return;



	/* Skip if the device BOS descriptor couldn't be read */

	if (!udev->bos)

		return;



	hub = usb_hub_to_struct_hub(udev->parent);

	/* It doesn't take time to transition the roothub into U0, since it

	 * doesn't have an upstream link.
@@ -2682,7 +2690,8 @@ int usb_authorize_device(struct usb_device *usb_dev) 
}



/*

 * Return 1 if port speed is SuperSpeedPlus, 0 otherwise

 * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the

 * capability couldn't be checked.

 * check it from the link protocol field of the current speed ID attribute.

 * current speed ID is got from ext port status request. Sublink speed attribute

 * table is returned with the hub BOS SSP device capability descriptor
@@ -2692,8 +2701,12 @@ static int port_speed_is_ssp(struct usb_device *hdev, int speed_id) 
	int ssa_count;

	u32 ss_attr;

	int i;

	struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap;

	struct usb_ssp_cap_descriptor *ssp_cap;



	if (!hdev->bos)

		return 0;



	ssp_cap = hdev->bos->ssp_cap;

	if (!ssp_cap)

		return 0;
@@ -4112,8 +4125,15 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev, 
		enum usb3_link_state state)

{

	int timeout, ret;

	__u8 u1_mel = udev->bos->ss_cap->bU1devExitLat;

	__le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat;

	__u8 u1_mel;

	__le16 u2_mel;



	/* Skip if the device BOS descriptor couldn't be read */

	if (!udev->bos)

		return;



	u1_mel = udev->bos->ss_cap->bU1devExitLat;

	u2_mel = udev->bos->ss_cap->bU2DevExitLat;



	/* If the device says it doesn't have *any* exit latency to come out of

	 * U1 or U2, it's probably lying.  Assume it doesn't implement that link

drivers/usb/core/hub.h

+1 −1
Original line number Diff line number Diff line
@@ -141,7 +141,7 @@ static inline int hub_is_superspeedplus(struct usb_device *hdev) 
{

	return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS &&

		le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 &&

		hdev->bos->ssp_cap);

		hdev->bos && hdev->bos->ssp_cap);

}



static inline unsigned hub_power_on_good_delay(struct usb_hub *hub)