| From: Johan Hovold <johan@kernel.org> |
| Date: Mon, 13 Jan 2020 10:38:57 -0800 |
| Subject: Input: keyspan-remote - fix control-message timeouts |
| |
| commit ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 upstream. |
| |
| The driver was issuing synchronous uninterruptible control requests |
| without using a timeout. This could lead to the driver hanging on probe |
| due to a malfunctioning (or malicious) device until the device is |
| physically disconnected. While sleeping in probe the driver prevents |
| other devices connected to the same hub from being added to (or removed |
| from) the bus. |
| |
| The USB upper limit of five seconds per request should be more than |
| enough. |
| |
| Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote") |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Link: https://lore.kernel.org/r/20200113171715.30621-1-johan@kernel.org |
| Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/input/misc/keyspan_remote.c | 9 ++++++--- |
| 1 file changed, 6 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/input/misc/keyspan_remote.c |
| +++ b/drivers/input/misc/keyspan_remote.c |
| @@ -344,7 +344,8 @@ static int keyspan_setup(struct usb_devi |
| int retval = 0; |
| |
| retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), |
| - 0x11, 0x40, 0x5601, 0x0, NULL, 0, 0); |
| + 0x11, 0x40, 0x5601, 0x0, NULL, 0, |
| + USB_CTRL_SET_TIMEOUT); |
| if (retval) { |
| dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n", |
| __func__, retval); |
| @@ -352,7 +353,8 @@ static int keyspan_setup(struct usb_devi |
| } |
| |
| retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), |
| - 0x44, 0x40, 0x0, 0x0, NULL, 0, 0); |
| + 0x44, 0x40, 0x0, 0x0, NULL, 0, |
| + USB_CTRL_SET_TIMEOUT); |
| if (retval) { |
| dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n", |
| __func__, retval); |
| @@ -360,7 +362,8 @@ static int keyspan_setup(struct usb_devi |
| } |
| |
| retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), |
| - 0x22, 0x40, 0x0, 0x0, NULL, 0, 0); |
| + 0x22, 0x40, 0x0, 0x0, NULL, 0, |
| + USB_CTRL_SET_TIMEOUT); |
| if (retval) { |
| dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n", |
| __func__, retval); |
