Merge tag 'usb-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB fixes for 4.20-rc6

  The "largest" here are some xhci fixes for reported issues. Also here
  is a USB core fix, some quirk additions, and a usb-serial fix which
  required the export of one of the tty layer's functions to prevent
  code duplication. The tty maintainer agreed with this change.

  All of these have been in linux-next with no reported issues"

* tag 'usb-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  xhci: Prevent U1/U2 link pm states if exit latency is too long
  xhci: workaround CSS timeout on AMD SNPS 3.0 xHC
  USB: check usb_get_extra_descriptor for proper size
  USB: serial: console: fix reported terminal settings
  usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
  USB: Fix invalid-free bug in port_over_current_notify()
  usb: appledisplay: Add 27" Apple Cinema Display

3 files changed, 10 insertions, 5 deletions

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 0f9381b69a3b..f76b2e0aba9d 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2251,7 +2251,7 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
                 /* descriptor may appear anywhere in config */
                 err = __usb_get_extra_descriptor(udev->rawdescriptors[0],
                                 le16_to_cpu(udev->config[0].desc.wTotalLength),
-                                USB_DT_OTG, (void **) &desc);
+                                USB_DT_OTG, (void **) &desc, sizeof(*desc));
                 if (err || !(desc->bmAttributes & USB_OTG_HNP))
                         return 0;
 
@@ -5163,7 +5163,7 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
 /* Handle notifying userspace about hub over-current events */
 static void port_over_current_notify(struct usb_port *port_dev)
 {
-        static char *envp[] = { NULL, NULL, NULL };
+        char *envp[3];
         struct device *hub_dev;
         char *port_dev_path;
 
@@ -5187,6 +5187,7 @@ static void port_over_current_notify(struct usb_port *port_dev)
         if (!envp[1])
                 goto exit;
 
+        envp[2] = NULL;
         kobject_uevent_env(&hub_dev->kobj, KOBJ_CHANGE, envp);
 
         kfree(envp[1]);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 0690fcff0ea2..514c5214ddb2 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -333,6 +333,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Midiman M-Audio Keystation 88es */
         { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* SanDisk Ultra Fit and Ultra Flair */
+        { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
+        { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
+
         /* M-Systems Flash Disk Pioneers */
         { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 79d8bd7a612e..4ebfbd737905 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number);
  */
 
 int __usb_get_extra_descriptor(char *buffer, unsigned size,
-                               unsigned char type, void **ptr)
+                               unsigned char type, void **ptr, size_t minsize)
 {
         struct usb_descriptor_header *header;
 
         while (size >= sizeof(struct usb_descriptor_header)) {
                 header = (struct usb_descriptor_header *)buffer;
 
-                if (header->bLength < 2) {
+                if (header->bLength < 2 || header->bLength > size) {
                         printk(KERN_ERR
                                 "%s: bogus descriptor, type %d length %d\n",
                                 usbcore_name,
@@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
                         return -1;
                 }
 
-                if (header->bDescriptorType == type) {
+                if (header->bDescriptorType == type && header->bLength >= minsize) {
                         *ptr = header;
                         return 0;
                 }