2 files changed, 33 insertions, 25 deletions

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 24dfb33f90cb..a16c538d0132 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -80,38 +80,18 @@ static int usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
         int max_tx;
         int i;
 
-        /* Allocate space for the SS endpoint companion descriptor */
-        ep->ss_ep_comp = kzalloc(sizeof(struct usb_host_ss_ep_comp),
-                        GFP_KERNEL);
-        if (!ep->ss_ep_comp)
-                return -ENOMEM;
         desc = (struct usb_ss_ep_comp_descriptor *) buffer;
         if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP) {
                 dev_warn(ddev, "No SuperSpeed endpoint companion for config %d "
                                 " interface %d altsetting %d ep %d: "
                                 "using minimum values\n",
                                 cfgno, inum, asnum, ep->desc.bEndpointAddress);
-                ep->ss_ep_comp->desc.bLength = USB_DT_SS_EP_COMP_SIZE;
-                ep->ss_ep_comp->desc.bDescriptorType = USB_DT_SS_ENDPOINT_COMP;
-                ep->ss_ep_comp->desc.bMaxBurst = 0;
-                /*
-                 * Leave bmAttributes as zero, which will mean no streams for
-                 * bulk, and isoc won't support multiple bursts of packets.
-                 * With bursts of only one packet, and a Mult of 1, the max
-                 * amount of data moved per endpoint service interval is one
-                 * packet.
-                 */
-                if (usb_endpoint_xfer_isoc(&ep->desc) ||
-                                usb_endpoint_xfer_int(&ep->desc))
-                        ep->ss_ep_comp->desc.wBytesPerInterval =
-                                ep->desc.wMaxPacketSize;
                 /*
                  * The next descriptor is for an Endpoint or Interface,
                  * no extra descriptors to copy into the companion structure,
                  * and we didn't eat up any of the buffer.
                  */
-                retval = 0;
-                goto valid;
+                return 0;
         }
         memcpy(&ep->ss_ep_comp->desc, desc, USB_DT_SS_EP_COMP_SIZE);
         desc = &ep->ss_ep_comp->desc;
@@ -320,6 +300,28 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                 buffer += i;
                 size -= i;
 
+                /* Allocate space for the SS endpoint companion descriptor */
+                endpoint->ss_ep_comp = kzalloc(sizeof(struct usb_host_ss_ep_comp),
+                                GFP_KERNEL);
+                if (!endpoint->ss_ep_comp)
+                        return -ENOMEM;
+
+                /* Fill in some default values (may be overwritten later) */
+                endpoint->ss_ep_comp->desc.bLength = USB_DT_SS_EP_COMP_SIZE;
+                endpoint->ss_ep_comp->desc.bDescriptorType = USB_DT_SS_ENDPOINT_COMP;
+                endpoint->ss_ep_comp->desc.bMaxBurst = 0;
+                /*
+                 * Leave bmAttributes as zero, which will mean no streams for
+                 * bulk, and isoc won't support multiple bursts of packets.
+                 * With bursts of only one packet, and a Mult of 1, the max
+                 * amount of data moved per endpoint service interval is one
+                 * packet.
+                 */
+                if (usb_endpoint_xfer_isoc(&endpoint->desc) ||
+                                usb_endpoint_xfer_int(&endpoint->desc))
+                        endpoint->ss_ep_comp->desc.wBytesPerInterval =
+                                endpoint->desc.wMaxPacketSize;
+
                 if (size > 0) {
                         retval = usb_parse_ss_endpoint_companion(ddev, cfgno,
                                         inum, asnum, endpoint, num_ep, buffer,
@@ -329,6 +331,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                                 retval = buffer - buffer0;
                         }
                 } else {
+                        dev_warn(ddev, "config %d interface %d altsetting %d "
+                                "endpoint 0x%X has no "
+                                "SuperSpeed companion descriptor\n",
+                                cfgno, inum, asnum, d->bEndpointAddress);
                         retval = buffer - buffer0;
                 }
         } else {
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 38b8bce782d6..4247eccf858c 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -595,7 +595,7 @@ static int usbdev_open(struct inode *inode, struct file *file)
         if (!ps)
                 goto out;
 
-        ret = -ENOENT;
+        ret = -ENODEV;
 
         /* usbdev device-node */
         if (imajor(inode) == USB_DEVICE_MAJOR)
@@ -1321,7 +1321,8 @@ static int get_urb32(struct usbdevfs_urb *kurb,
                      struct usbdevfs_urb32 __user *uurb)
 {
         __u32  uptr;
-        if (get_user(kurb->type, &uurb->type) ||
+        if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
+            __get_user(kurb->type, &uurb->type) ||
             __get_user(kurb->endpoint, &uurb->endpoint) ||
             __get_user(kurb->status, &uurb->status) ||
             __get_user(kurb->flags, &uurb->flags) ||
@@ -1536,8 +1537,9 @@ static int proc_ioctl_compat(struct dev_state *ps, compat_uptr_t arg)
         u32 udata;
 
         uioc = compat_ptr((long)arg);
-        if (get_user(ctrl.ifno, &uioc->ifno) ||
-            get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
+        if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
+            __get_user(ctrl.ifno, &uioc->ifno) ||
+            __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
             __get_user(udata, &uioc->data))
                 return -EFAULT;
         ctrl.data = compat_ptr(udata);