Mathias Nyman f9a5b4f58b usb: Avoid use-after-free by flushing endpoints early in usb_set_interface() ... The steps taken by usb core to set a new interface is very different from what is done on the xHC host side. xHC hardware will do everything in one go. One command is used to set up new endpoints, free old endpoints, check bandwidth, and run the new endpoints. All this is done by xHC when usb core asks the hcd to check for available bandwidth. At this point usb core has not yet flushed the old endpoints, which will cause use-after-free issues in xhci driver as queued URBs are cancelled on a re-allocated endpoint. To resolve this add a call to usb_disable_interface() which will flush the endpoints before calling usb_hcd_alloc_bandwidth() Additional checks in xhci driver will also be implemented to gracefully handle stale URB cancel on freed and re-allocated endpoints Cc: <stable@vger.kernel.org> Reported-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-09-05 14:36:53 +02:00
..
accessibility	…
acpi	libnvdimm-for-4.19_misc	2018-08-25 18:13:10 -07:00
amba	…
android	android: binder: Rate-limit debug and userspace triggered err msgs	2018-08-08 11:05:47 +02:00
ata	ata: ftide010: Add a quirk for SQ201	2018-08-27 14:25:54 -06:00
atm	…
auxdisplay	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
base	PM / clk: signedness bug in of_pm_clk_add_clks()	2018-08-24 11:52:34 +02:00
bcma	…
block	for-linus-20180830	2018-08-30 13:39:04 -07:00
bluetooth	Bluetooth: mediatek: Fix memory leak	2018-08-21 16:56:20 +02:00
bus	Merge branch 'perm-fix' into omap-for-v4.19/fixes-v2	2018-08-28 09:58:03 -07:00
cdrom	cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status	2018-08-29 08:09:20 -06:00
char	RTC for 4.19	2018-08-20 16:30:27 -07:00
clk	clk: x86: Set default parent to 48Mhz	2018-08-30 14:47:41 -07:00
clocksource	RISC-V Updates for the 4.19 Merge Window	2018-08-19 09:56:38 -07:00
connector	…
cpufreq	ARM: SoC driver updates	2018-08-23 13:52:46 -07:00
cpuidle	cpuidle: menu: Retain tick when shallow state is selected	2018-08-25 13:16:08 +02:00
crypto	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2018-08-29 13:38:39 -07:00
dax	libnvdimm-for-4.19_dax-memory-failure	2018-08-25 18:43:59 -07:00
dca	…
devfreq	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
dio	…
dma	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
dma-buf	…
edac	EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[]	2018-08-17 15:13:34 +02:00
eisa	…
extcon	…
firewire	firewire: use 64-bit time_t based interfaces	2018-08-17 16:20:27 -07:00
firmware	fbdev changes for v4.19:	2018-08-23 15:44:58 -07:00
fmc	…
fpga	…
fsi	fsi: sbefifo: Bump max command length	2018-08-08 15:44:47 +10:00
gnss	…
gpio	- New Drivers	2018-08-20 15:38:44 -07:00
gpu	- fix for GLK and CNL watermark workaround	2018-08-30 11:35:03 +10:00
hid	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid	2018-08-20 15:59:01 -07:00
hsi	…
hv	…
hwmon	hwmon: (nct6775) Fix potential Spectre v1	2018-08-26 17:45:25 -07:00
hwspinlock	…
hwtracing	drivers/hwtracing/intel_th/msu.c: change return type to vm_fault_t	2018-08-23 18:48:43 -07:00
i2c	i2c: sh_mobile: fix leak when using DMA bounce buffer	2018-08-30 23:13:59 +02:00
ide	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide	2018-08-22 07:40:33 -07:00
idle	…
iio	treewide: convert ISO_8859-1 text comments to utf-8	2018-08-23 18:48:43 -07:00
infiniband	Second merge window update	2018-08-23 15:34:48 -07:00
input	ARM: 32-bit SoC platform updates	2018-08-23 13:44:43 -07:00
iommu	ARM: SoC: late updates	2018-08-25 14:12:36 -07:00
ipack	…
irqchip	Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-26 09:55:28 -07:00
isdn	isdn: Disable IIOCDBGVAR	2018-08-16 12:26:24 -07:00
leds	leds: ns2: Change unsigned to unsigned int	2018-08-06 23:03:12 +02:00
lightnvm	…
macintosh	macintosh: therm_windtunnel: drop using attach_adapter	2018-08-24 14:42:42 +02:00
mailbox	mailbox: Add support for i.MX messaging unit	2018-08-15 09:53:07 +05:30
mcb	…
md	libnvdimm-for-4.19_misc	2018-08-25 18:13:10 -07:00
media	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
memory	ARM: SoC driver updates	2018-08-23 13:52:46 -07:00
memstick	…
message	…
mfd	Merge branch 'i2c/for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2018-08-21 17:40:46 -07:00
misc	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
mmc	mmc: renesas_sdhi_internal_dmac: mask DMAC interrupts	2018-08-23 10:00:49 +02:00
mtd	mtd: rawnand: denali: do not pass zero maxchips to nand_scan()	2018-08-27 20:41:46 +02:00
mux	…
net	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-08-27 11:59:39 -07:00
nfc	…
ntb	…
nubus	…
nvdimm	libnvdimm-for-4.19_dax-memory-failure	2018-08-25 18:43:59 -07:00
nvme	nvmet: free workqueue object if module init fails	2018-08-28 08:40:44 +02:00
nvmem	…
of	of: add node name compare helper functions	2018-08-30 13:53:05 -05:00
opp	…
oprofile	…
parisc	…
parport	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
pci	Merge branch 'akpm' (patches from Andrew)	2018-08-22 12:34:08 -07:00
pcmcia	pcmcia: remove long deprecated pcmcia_request_exclusive_irq() function	2018-08-18 12:30:42 -07:00
perf	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
phy	…
pinctrl	- New Drivers	2018-08-20 15:38:44 -07:00
platform	platform-drivers-x86 for v4.19-1	2018-08-22 14:14:15 -07:00
pnp	…
power	treewide: convert ISO_8859-1 text comments to utf-8	2018-08-23 18:48:43 -07:00
powercap	…
pps	…
ps3	…
ptp	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
pwm	pwm: mediatek: Add MT7628 support	2018-08-20 11:36:07 +02:00
rapidio	drivers/rapidio/devices/rio_mport_cdev.c: remove redundant pointer md	2018-08-22 10:52:51 -07:00
ras	…
regulator	- New Drivers	2018-08-20 15:38:44 -07:00
remoteproc	remoteproc/davinci: use the reset framework	2018-08-16 17:39:55 -07:00
reset	ARM: SoC: late updates	2018-08-25 14:12:36 -07:00
rpmsg	…
rtc	RTC for 4.19	2018-08-20 16:30:27 -07:00
s390	libnvdimm-for-4.19_misc	2018-08-25 18:13:10 -07:00
sbus	…
scsi	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
sfi	…
sh	sh: introduce a sh_cacheop_vaddr helper	2018-08-02 13:54:06 +02:00
siox	…
slimbus	…
sn	…
soc	ARM: Device-tree updates	2018-08-23 14:02:22 -07:00
soundwire	…
spi	hwspinlock updates for v4.19	2018-08-18 16:45:27 -07:00
spmi	…
ssb	ssb: Remove SSB_WARN_ON, SSB_BUG_ON and SSB_DEBUG	2018-08-09 18:47:47 +03:00
staging	ARM: SoC driver updates	2018-08-23 13:52:46 -07:00
target	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
tc	…
tee	ARM: SoC driver updates	2018-08-23 13:52:46 -07:00
thermal	Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal	2018-08-28 16:11:34 -07:00
thunderbolt	…
tty	powerpc fixes for 4.19 #2	2018-08-24 09:34:23 -07:00
uio	Char/Misc fix for 4.19-rc1	2018-08-19 09:30:44 -07:00
usb	usb: Avoid use-after-free by flushing endpoints early in usb_set_interface()	2018-09-05 14:36:53 +02:00
uwb	…
vfio	powerpc updates for 4.19	2018-08-17 11:32:50 -07:00
vhost	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-08-27 11:59:39 -07:00
video	fbdev changes for v4.19:	2018-08-23 15:44:58 -07:00
virt	…
virtio	virtio, vhost: fixes, tweaks	2018-08-24 08:45:19 -07:00
visorbus	…
vlynq	…
vme	…
w1	power supply and reset changes for the v4.19 series	2018-08-21 18:06:27 -07:00
watchdog	include/linux/compiler*.h: make compiler-*.h mutually exclusive	2018-08-22 17:31:34 -07:00
xen	xen: fixes for 4.19-rc2	2018-08-31 08:45:16 -07:00
zorro	…
Kconfig	…
Makefile	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00