)]}' { "log": [ { "commit": "bd86478bb8d09abd0aba8ead781bc8f4609521e6", "tree": "cf9afd6f290beaef9c8b3b4da17274287bba4de9", "parents": [ "a3fd6202e475dbc26761384fb892f2c9b7f6d5f2" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:58:35 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:41:35 2026 +0200" }, "message": "tests: add lsusb -- end-of-options test\n\ngetopt_long() stops at --, and lsusb rejects positionals\n(argc \u003e optind), so anything after -- is a usage error while a bare\ntrailing -- is a no-op. Pin both, plus a built-vs-installed diff\non the error path.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a3fd6202e475dbc26761384fb892f2c9b7f6d5f2", "tree": "2dc75a6a943a6416791df0e9bbde1ef57205796e", "parents": [ "186cbbd784db2d629547cceb2a35ad6c5e417c94" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:58:01 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:41:35 2026 +0200" }, "message": "tests: add lsusb -P/-p vestigial-option test\n\n-P: and -p: are still in the getopt optstring but have no case in\nthe switch, so they consume their argument and fall through to\ndefault / err++. That differs from an unknown option (-X), where\ngetopt itself prints an \"invalid option\" line: -p/-P go straight to\nthe usage text. Pin both, and diff against the installed binary.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "186cbbd784db2d629547cceb2a35ad6c5e417c94", "tree": "4a18705d4d0349897bfca5a1ee1add7cff49c81a", "parents": [ "a3f6b2437f7fa8394dd3b0388d8f48195ddb93c3" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:57:22 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:41:35 2026 +0200" }, "message": "tests: add lsusb -D error-path tests\n\nA -D argument that doesn\u0027t resolve to an attached device through\n/dev/bus/usb/BBB/DDD yields \"Cannot open \u003carg\u003e\" on stderr and exit 1.\nCover a missing path, a non-USB device node, a well-formed but\nnon-existent bus/devnum, and diff the error output against the\ninstalled binary in both the brief and -v paths.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a3f6b2437f7fa8394dd3b0388d8f48195ddb93c3", "tree": "1b7cca9afdfbb6adba27b0f0f57a46e7c30b64e3", "parents": [ "d1b8c0d7f47fcb972efa3298420a489d0f7b0860" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:56:29 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:41:35 2026 +0200" }, "message": "tests: add lsusb -d :pid product-only filter test\n\nlsusb-d-wildcard.brat covers the vendor-only and bare-colon -d forms\nbut not :pid (vendor stays at the -1 wildcard, product set). Use\nthe first attached device\u0027s product id so the filter has to match\nat least one line, and diff against the installed binary in both\nthe brief and -v paths.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d1b8c0d7f47fcb972efa3298420a489d0f7b0860", "tree": "adadde4de62d3753ccdba238cd5fb4f548931a12", "parents": [ "00d5cc69b725815e56c26db38cb51b7e8f6710ac" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:55:54 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:41:35 2026 +0200" }, "message": "tests: add lsusb repeated -s/-d/-D test\n\nThe -s and -d parsers assign bus/devnum/vendor/product per-field\nonly when that side of the colon is non-empty, so a later -s :dev\noverrides devnum but leaves bus, and a trailing -s : is a no-op\nrather than a reset. -D is a plain pointer store so the last one\nwins outright. Pin all five behaviours plus a built-vs-installed\ndiff that actually has to match a device.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "00d5cc69b725815e56c26db38cb51b7e8f6710ac", "tree": "a94990434723555218e9326a7d8a52d7a8906ec7", "parents": [ "0ff3f1741189ae20f11e9b39c0c30a5a09788f41" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:54:33 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:41:35 2026 +0200" }, "message": "tests: add lsusb -h precedence test\n\nUnlike -V, -h sets a flag and lets the getopt loop run to completion,\nso every other option is parsed (and -d nocolon still sets err++)\nbefore the usage is printed. Exit status is 0 only when help \u0026\u0026 !err.\nPin -h with each selector individually and all together, the\nhelp-plus-error exit-1 case, and a built-vs-installed diff.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0ff3f1741189ae20f11e9b39c0c30a5a09788f41", "tree": "f854f9e3afd74c420de476d72e02393b78142f94", "parents": [ "e3775d09ec5dec5cb9db02d99bf50e8d0a1c5203" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:53:55 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:39:53 2026 +0200" }, "message": "tests: add lsusb -V precedence test\n\n-V returns from main() the moment getopt yields it, so options to\nits right are unparsed and options (and option errors) to its left\nare discarded. Pin all four cases: -v before, the full -t/-s/-d/-D\nset after, an option-parse error before, and a stray positional\nafter.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e3775d09ec5dec5cb9db02d99bf50e8d0a1c5203", "tree": "96fb6643b7524085c01d76552f4948ce320ddb4e", "parents": [ "4dedb6ea73c91b52d4d79cf19a292437f69da5b9" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:53:15 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:39:53 2026 +0200" }, "message": "tests: add lsusb -D precedence test (-s/-d ignored under -D)\n\nWhen -D is given main() calls dump_one_device() instead of\nlist_devices(), so the -s/-d filters are parsed but never reach a\nconsumer. Pin that with two self-comparison tests against -D alone\nand a built-vs-installed diff with -v and both filters set.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4dedb6ea73c91b52d4d79cf19a292437f69da5b9", "tree": "cd20607a6d12800d153c7290d0d6b513aebbd630", "parents": [ "f872f7f727154fcc13bf765d75379c1ade870ad8" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:52:35 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:39:53 2026 +0200" }, "message": "tests: add lsusb -t precedence test (-s/-d/-D ignored under -t)\n\nmain() branches into lsusb_t() before any of the -s/-d/-D selectors\nare consulted, so the tree output must be byte-identical regardless.\nPin that with three self-comparison tests and one built-vs-installed\ndiff with all three selectors set at once.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f872f7f727154fcc13bf765d75379c1ade870ad8", "tree": "436eb8a5153e7469dd23310907d8620271b4a22e", "parents": [ "80cb4b6e3e54ef658bd750ec9963d46960053f21" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 26 19:59:44 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:38:22 2026 +0200" }, "message": "tests: add lsusb -h/-V interaction test\n\n-h sets a flag and continues the getopt loop; -V returns from main()\nthe moment it\u0027s seen. So both -h -V and -V -h print the version\nline on stdout, nothing on stderr, and exit 0; the help flag never\nreaches the (help \u0026\u0026 !err) check. Last unordered pair in the\nseven-option matrix.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "80cb4b6e3e54ef658bd750ec9963d46960053f21", "tree": "176fbf029e4dcb72248595bfbfd06bf20ea5b595", "parents": [ "19ece77c319e91a5a057e349bfc3024de0f27c57" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 16:14:58 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:37:48 2026 +0200" }, "message": "tests: add lsusb.py argument-combination brat tests\n\nSix new .brat files covering the option mixes the existing per-option\ntests don\u0027t reach:\n\n lsusb.py-ciu.brat -ciu (the combination --help recommends),\n split-flag and long-option equivalence\n lsusb.py-ie.brat -Cie, -CIe, -CIew (detail-stacking)\n lsusb.py-Ui.brat -Cui/-CUi/-CuI/-CUI (hub-filter x interface),\n and that -U subsumes -u\n lsusb.py-cC.brat -cC and -Cc override semantics\n lsusb.py-fi.brat -f path with -Cie / -CIew, plus -f /dev/null\n lsusb.py-err.brat unknown option, -f without arg, stray positional\n\nEach compare test diffs the just-built script against the installed one\nthe same way the existing lsusb.py*.brat files do; the equivalence and\nsubsumption tests diff the built script against itself. -C is added to\nthe multi-flag combinations to keep the diff byte-for-byte regardless of\nisatty().\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "19ece77c319e91a5a057e349bfc3024de0f27c57", "tree": "ca039ea657807bb5879ce15b2e86777d1262df8f", "parents": [ "7c92e0440217b9bfd2b791bb617cb90baa23f0aa" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 15:32:40 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:36:46 2026 +0200" }, "message": "tests: add lsusb argument-combination brat tests\n\nSeven new .brat files covering the option mixes the existing per-option\ntests don\u0027t reach:\n\n lsusb-vv.brat -vv, -v -v\n lsusb-tvv.brat -tvv, -tvvv, -t --verbose --verbose\n lsusb-s-wildcard.brat -s bus:, -s :dev, -s dev, -s :\n lsusb-d-wildcard.brat -d vid:, -d :, -v -d vid:\n lsusb-sd.brat -s and -d together, plus a no-intersection check\n lsusb-long.brat --verbose vs -v, --version vs -V\n lsusb-err.brat unknown option, stray positional, -d without colon\n\nEach compare test diffs the just-built binary against the installed one\nthe same way the existing lsusb*.brat files do; the wildcard and\nlong-option equivalence tests diff the built binary against itself.\nThe unknown-option compare strips getopt(3)\u0027s argv[0]-prefixed first\nline.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7c92e0440217b9bfd2b791bb617cb90baa23f0aa", "tree": "02661a8126aabf60b0ea33991656acf56621f498", "parents": [ "68123dc0e833d93516b5fb06f80983ad39af0f4d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 19:58:15 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:33:59 2026 +0200" }, "message": "tests: usbhid-dump -e: compare built against installed\n\nCompare -e descriptor output of the just-built usbhid-dump against the\ninstalled copy, and check that --entity is an alias for -e.\n\n-e stream / -e all capture live interrupt transfers and are inherently\nnon-deterministic; -t/-p/-f only affect stream mode. None of those are\ndiff-testable, so they are deliberately not covered here.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "68123dc0e833d93516b5fb06f80983ad39af0f4d", "tree": "5954134c16d0f0542d12d2ea12aeb8aea36c55e2", "parents": [ "f605f43e24463a1bce6925fc4979b1a3d683a40a" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 19:58:15 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:33:59 2026 +0200" }, "message": "tests: usbhid-dump -i: compare built against installed\n\nCompare -i 255 (the wildcard interface number) output of the just-built\nusbhid-dump against the installed copy, and check that --interface is\nan alias for -i.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f605f43e24463a1bce6925fc4979b1a3d683a40a", "tree": "eb922a7ea8c5d77c77347a01e00335e010e1f01a", "parents": [ "05a1f77636621fa774865a259c76088b381976d1" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 19:58:15 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:33:59 2026 +0200" }, "message": "tests: usbhid-dump -d: compare built against installed\n\nCompare -d 0000:0000 (the wildcard vid:pid) output of the just-built\nusbhid-dump against the installed copy, and check that -m and --model\nare aliases for -d.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "05a1f77636621fa774865a259c76088b381976d1", "tree": "dcc93a3d8f2cfc1a27bb56da28f59e3c82f905ae", "parents": [ "63259c77e28af36eb737b2c4e6412f63d1f0b750" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 19:58:15 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:33:59 2026 +0200" }, "message": "tests: usbhid-dump -s: compare built against installed\n\nCompare -s 0:0 (the wildcard bus:dev) output of the just-built\nusbhid-dump against the installed copy, and check that -a and\n--address are aliases for -s.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "63259c77e28af36eb737b2c4e6412f63d1f0b750", "tree": "8c1c2823a6fe6dbede8ec5b31a43cb6ce9484a0e", "parents": [ "7a74b5bd3fb213b28a03621a89609234ac3dd9af" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 19:58:15 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:33:59 2026 +0200" }, "message": "tests: usbhid-dump -h: compare built against installed\n\nCompare the help text of the just-built usbhid-dump against the\ninstalled copy, and check that --help is an alias for -h.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7a74b5bd3fb213b28a03621a89609234ac3dd9af", "tree": "0d026b38af129d61eaf821489ecfd3b58a5a4715", "parents": [ "0f13de5baf33a98b8cacce9ebd102c033c891de8" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 19:58:15 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:33:59 2026 +0200" }, "message": "tests: usbhid-dump: compare built against installed\n\nCompare the bare (-e descriptor) invocation of the just-built\nusbhid-dump against the installed copy, and check that -v reports a\nversion. usbhid-dump claims HID interfaces, so an unprivileged run\nproduces a permission error; both binaries should fail identically,\nwhich is still a valid comparison. The device-touching invocations\ntolerate non-zero exit so the diff still runs.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0f13de5baf33a98b8cacce9ebd102c033c891de8", "tree": "5a732195f6358f511430e8b648697991351a6352", "parents": [ "c1a020adc8ffd7f2dc46b4e46ffc47a0108e58d8", "d23f7a86f40d6663c78a5130c1e229d7915137b3" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jul 03 13:29:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 13:29:46 2026 +0200" }, "message": "Merge pull request #254 from gregkh/dependabot/github_actions/all-actions-e5cea2f69c\n\nci: bump the all-actions group with 5 updates" }, { "commit": "d23f7a86f40d6663c78a5130c1e229d7915137b3", "tree": "5a732195f6358f511430e8b648697991351a6352", "parents": [ "c1a020adc8ffd7f2dc46b4e46ffc47a0108e58d8" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Jul 01 22:34:16 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 01 22:34:16 2026 +0000" }, "message": "ci: bump the all-actions group with 5 updates\n\nBumps the all-actions group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `7.0.0` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.1` | `4.36.2` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.1` | `4.36.2` |\n| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.1` | `4.36.2` |\n| [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` |\n\n\nUpdates `actions/checkout` from 6.0.3 to 7.0.0\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)\n\nUpdates `github/codeql-action/init` from 4.36.1 to 4.36.2\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)\n\nUpdates `github/codeql-action/analyze` from 4.36.1 to 4.36.2\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)\n\nUpdates `github/codeql-action/upload-sarif` from 4.36.1 to 4.36.2\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)\n\nUpdates `actions/setup-python` from 6.2.0 to 6.3.0\n- [Release notes](https://github.com/actions/setup-python/releases)\n- [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1)\n\n---\nupdated-dependencies:\n- dependency-name: actions/checkout\n dependency-version: 7.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: all-actions\n- dependency-name: github/codeql-action/init\n dependency-version: 4.36.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: all-actions\n- dependency-name: github/codeql-action/analyze\n dependency-version: 4.36.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: all-actions\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: 4.36.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: all-actions\n- dependency-name: actions/setup-python\n dependency-version: 6.3.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: all-actions\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "c1a020adc8ffd7f2dc46b4e46ffc47a0108e58d8", "tree": "d9e37522b662d457583df885e5ab04c2c368c613", "parents": [ "022e9a08d6ccfe938131b99b317e500d71fc9cd1" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 19 17:14:03 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 19 17:14:03 2026 +0200" }, "message": "lsusb: fix up parsing for older uvc devices\n\nThe descriptor length of uvc devices depends on the version of the\ndevice. Check the version before determining what the length is so that\nthe descriptor information can be properly handled.\n\nFixes up camera handling for some of my devices that was previously\nbroken on older versions of lsusb.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "022e9a08d6ccfe938131b99b317e500d71fc9cd1", "tree": "5a66f42e7d463a7da7acf83ec3dc7173b2fc3a27", "parents": [ "0b2cf99efc38b53eb991b65e1125cc2957cd553d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 19 17:02:31 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 19 17:02:31 2026 +0200" }, "message": "meson.build: turn off -Wno-unused-function\n\nWe want this warning to show up if it\u0027s present.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0b2cf99efc38b53eb991b65e1125cc2957cd553d", "tree": "89aad2a31c957eaee21b73fdddd3ebcba7966d8f", "parents": [ "be4442c7c9d46d5689f2257033e830c5c059de7c" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 19 11:32:37 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 19 11:32:37 2026 +0200" }, "message": "lsusb: add expected length message for video descriptor endpoint\n\nA device with an invalid descriptor length should print out what the\nexpected value is before aborting, to give a hint as to what went wrong.\nDo this for the video descriptor processing unit endpoint as I have a\ndevice that fails this check.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "be4442c7c9d46d5689f2257033e830c5c059de7c", "tree": "1561b48860fd8b1f45b4bdc8ac13e9debc127e02", "parents": [ "d0cfdc508d51d4d3ec4cfc0026120f48b9bb250b", "8a589214eccba39a9580e4c6bd64fa1267fc0399" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 12 21:33:48 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jun 12 21:33:48 2026 +0200" }, "message": "Merge pull request #253 from Wer-Wolf/fwstatus\n\nlsusb: Add support for FWStatus Capability decoding" }, { "commit": "8a589214eccba39a9580e4c6bd64fa1267fc0399", "tree": "1561b48860fd8b1f45b4bdc8ac13e9debc127e02", "parents": [ "d0cfdc508d51d4d3ec4cfc0026120f48b9bb250b" ], "author": { "name": "Armin Wolf", "email": "W_Armin@gmx.de", "time": "Thu Jun 11 16:30:56 2026 +0200" }, "committer": { "name": "Armin Wolf", "email": "W_Armin@gmx.de", "time": "Thu Jun 11 16:36:50 2026 +0200" }, "message": "lsusb: Add support for FWStatus Capability decoding\n\nThe USB 3.2 Revision 1.1 Specification (Section 9.6.2.8) has defined\nan additional device capability descriptor for reporting the supported\noperations associated with the FWStatus capability.\n\nAdd support for this new device capability descriptor.\n\nSigned-off-by: Armin Wolf \u003cW_Armin@gmx.de\u003e\n" }, { "commit": "d0cfdc508d51d4d3ec4cfc0026120f48b9bb250b", "tree": "7bbbb6f2598d4f76c06e2f0dc31723acae0c4e80", "parents": [ "1ebaaecce92fa9b94087d140e3b39ff7cda10a0a", "55118301de766b39adf43e536f3fd14d0ff7df08" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 06 07:28:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jun 06 07:28:32 2026 +0200" }, "message": "Merge pull request #241 from cmheia/usb.ids\n\nlsusb.py: fix parse_usb_ids" }, { "commit": "1ebaaecce92fa9b94087d140e3b39ff7cda10a0a", "tree": "3293ef3de6cda5a14b0e41767c0c17559b2e6f13", "parents": [ "e1023c0005e1d84d5124e197cddf3547c2621829", "1bd28e3a01d25ce9c38cd479ca5613ed556f4a13" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 05 17:11:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jun 05 17:11:26 2026 +0200" }, "message": "Merge pull request #252 from gregkh/dependabot/github_actions/all-actions-3c815a503c\n\nci: bump the all-actions group with 2 updates" }, { "commit": "1bd28e3a01d25ce9c38cd479ca5613ed556f4a13", "tree": "3293ef3de6cda5a14b0e41767c0c17559b2e6f13", "parents": [ "e1023c0005e1d84d5124e197cddf3547c2621829" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Jun 03 12:55:48 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 03 12:55:48 2026 +0000" }, "message": "ci: bump the all-actions group with 2 updates\n\nBumps the all-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [github/codeql-action](https://github.com/github/codeql-action).\n\n\nUpdates `actions/checkout` from 6.0.2 to 6.0.3\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)\n\nUpdates `github/codeql-action` from 4.35.3 to 4.36.1\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...87557b9c84dde89fdd9b10e88954ac2f4248e463)\n\n---\nupdated-dependencies:\n- dependency-name: actions/checkout\n dependency-version: 6.0.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: all-actions\n- dependency-name: github/codeql-action\n dependency-version: 4.36.1\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: all-actions\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "e1023c0005e1d84d5124e197cddf3547c2621829", "tree": "64288e40b491136e171a61d05d1c766ccb5a55b2", "parents": [ "c7d48fedccb46624136186bd383f6c36429bd25a" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:24:57 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:24:57 2026 +0200" }, "message": "usbutils.spdx: update with new files added\n\nThere have been a lot of new test files added to the repo, so update the\n.spdx file to properly reflect these new additions\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c7d48fedccb46624136186bd383f6c36429bd25a", "tree": "9df59f1de99471a380d8f4b64e77449f0ce2b45b", "parents": [ "4b835c7c77bcf2a0d77ec27e264885e5b28916c5" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:20:36 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:20:36 2026 +0200" }, "message": "tests: brat: fix some spelling issues\n\ncodespell does not like misspelled words, so to shut it up, fix up 2\nupstream brat spelling issues so that it will be quiet.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4b835c7c77bcf2a0d77ec27e264885e5b28916c5", "tree": "97b58d34f4da845c80d6e2be6eebf932f24d00c4", "parents": [ "8307fe45d3249827ad2f08d77e5dbd02341efacc" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu May 28 17:01:22 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:17:02 2026 +0200" }, "message": "lsusb: don\u0027t pass NULL into %s for unknown HID report/usage tags\n\nnames_reporttag(), names_huts(), names_hutus() and names_hid() return\nNULL when the device-supplied tag / usage page / usage / descriptor type\nisn\u0027t in the static table, and the four call sites in dump_report_desc()\n/ dump_hid_device() pass that straight to printf %s. glibc and musl\nboth print \"(null)\" so this is cosmetic UB in practice; match the\nexisting names_countrycode() ?: \"Unknown\" idiom one line up.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8307fe45d3249827ad2f08d77e5dbd02341efacc", "tree": "f01c84949ca5ee648ac39a81f6236b2ab6a9f058", "parents": [ "036fb2b76c246b10c24d96801dab990228f1c42e" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu May 28 12:23:46 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:16:59 2026 +0200" }, "message": "lsusb: fix two -D path-resolution edge cases in usbmisc.c\n\nget_absolute_path() prepends getcwd() and a \u0027/\u0027 before walking a\nrelative -D argument, but the \u0027/\u0027 append is unguarded. When the cwd is\nexactly result_size-1 bytes long (PATH_MAX from the only caller) the \u0027/\u0027\nlands on the last byte, the walk loop is skipped because result_size has\ndropped to 0, and the trailing *presult \u003d 0 then writes one byte past\nresult[]. Guard the append the same way the walk loop already guards\nevery other write.\n\nget_usb_device() calls libusb_free_device_list(list, 1) on an\nuninitialised list pointer if libusb_get_device_list() returns a\nnegative error code. list_devices() in lsusb.c already early-returns in\nthat case; do the same here.\n\nNeither path is reachable from device input; both sit behind the\nhost-supplied -D argument and a degenerate cwd or a libusb enumeration\nfailure respectively.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "036fb2b76c246b10c24d96801dab990228f1c42e", "tree": "a2f8856c4d7dfbe26ee8f4b0ba9d028a51553f45", "parents": [ "b042c929778b0ec08d1816b764647533c1afd397" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu May 28 11:11:13 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:13:30 2026 +0200" }, "message": "usbhid-dump: bound the HID-descriptor-extra walk by entry end, not start\n\nThe three loop conditions in uhd_iface_list_new() check that the start\nof the next 3-byte uhd_hid_descriptor_extra entry is within bLength /\nextra_length, not that the whole entry is. A device that pads its HID\nclass descriptor to a length that isn\u0027t 6 + 3*N (e.g. extra_length 10\nwith bNumDescriptors \u003e\u003d 2 and a non-REPORT first entry) makes the last\niteration read wDescriptorLength one or two bytes past extra_length.\n\nlibusb\u0027s parse_interface() hands extra[] over as its own\nmalloc(extra_length), so this is a two-byte heap over-read; rd_len is\nclamped to 4096 downstream so the only impact is the read itself.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b042c929778b0ec08d1816b764647533c1afd397", "tree": "9bf56e6cf7a23e779d1f0c589ab8e763b120f312", "parents": [ "dfb418206f3e59f6213905ba2895035bd58d560d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu May 28 09:49:05 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:13:30 2026 +0200" }, "message": "lsusb: fix wHubDelay decoding in the USB3 hub descriptor dump\n\nwHubDelay is a little-endian u16 at bytes 8-9 of the SuperSpeed hub\ndescriptor. The dump has printed (p[8] \u003c\u003c 4) + p[7] since the USB 3.0\nhub support landed in 5f7c2006e45f, i.e. the wrong bytes and the wrong\nshift, so the value shown has always been bHubHdrDecLat plus the low\nbyte of wHubDelay shifted by a nibble.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dfb418206f3e59f6213905ba2895035bd58d560d", "tree": "56d04ec3db882d8f1fa0f4f3e384e261805043e0", "parents": [ "d10393a794275709a44ec3d23e6943e21b33019d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu May 28 16:39:33 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:13:30 2026 +0200" }, "message": "lsusb: bound the extra[] dispatch loops by remaining size\n\nThe config / interface / endpoint extra[] walks dispatch on buf[1] and\npass buf to a class-specific dumper that reads buf[0] bytes, but never\ncheck buf[0] against the bytes remaining in extra[], so a truncated tail\ndescriptor reads past extra + extra_length. libusb\u0027s\nparse_{configuration,interface,endpoint}() have rejected a bLength \u003e\nsize in the extra-collection pass since 1.0.16 (b42954bd5d3c, 2013), so\nthis is unreachable through any libusb in the last decade, but the\nwell-formedness guarantee is undocumented and the BOS-descriptor walk in\ndump_bos_descriptor() already carries the same guard. Match it.\n\nThe dump_junk() call in the previous buf[0] \u003c 2 arm was a no-op (buf[0]\n\u003c\u003d size early-returns); replace it with a diagnostic that also covers\nthe new buf[0] \u003e size case.\n\nWhile in here: the inline USB_DT_SS_ENDPOINT_COMP case in the endpoint\nloop reads buf[2..5] without checking bLength, so a companion descriptor\nwith bLength \u003c 6 reads up to four bytes past its own end. libusb\u0027s\nbLength floor is 2, so this one is reachable; extra[] is a separate\nmalloc(extra_length), so on a malicious device the over-read past the\nlast descriptor in the slice prints heap as bMaxBurst / MaxStreams /\nwBytesPerInterval. Warn and break on a short companion the way the\ncall-out cases already do.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d10393a794275709a44ec3d23e6943e21b33019d", "tree": "37deac64ea04f3fbda3e0e983ebeea81ffbaefa2", "parents": [ "40ac4c919b7626ac92cceedd1bb1e51d9f74a0ba" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 05 12:16:41 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:13:29 2026 +0200" }, "message": "lsusb: avoid undefined behaviour when assembling u32s from descriptor bytes\n\n`buf[i] \u003c\u003c 24` shifts a value that integer-promotes to signed int, so a\ndevice byte \u003e\u003d 0x80 shifts into the sign bit. Route every open-coded\n4-byte load through convert_le_u32() and fix the helper itself with an\nexplicit cast on the high byte.\n\nWhile here, mask the SuperSpeed-companion MaxStreams shift to bits 4:0\n(the gate already masks but the shift used the raw byte), drop the\nmisaligned uint16_t* cast in the IPP printer dumper, and make the CDC\nEthernet accumulator unsigned.\n\nAll of these only ever printed a wrong value, but they\u0027re real C UB on\nattacker-supplied bytes and trip -fsanitize\u003dundefined when the fuzz\ncorpus is replayed.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "40ac4c919b7626ac92cceedd1bb1e51d9f74a0ba", "tree": "63e79da3c3af7b2495cf138a53673add5552a4fd", "parents": [ "76acb155e078516d5dd4c18780281c4db88d77cf" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 03 14:32:17 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:13:29 2026 +0200" }, "message": "lsusb: check FORMAT_TYPE bLength before reading bFormatType\n\nThe UAC2 arm of dump_audiostreaming_interface()\u0027s FORMAT_TYPE case\nswitches on buf[3] before any of the per-format-type length checks run,\nso a 3-byte CS_INTERFACE descriptor (bLength/bDescriptorType/\nbDescriptorSubtype only) reads one byte past the declared length. Bail\nat the top of the case. The UAC1 arm already gates on buf[0] \u003c 8 first\nso this was UAC2-only.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "76acb155e078516d5dd4c18780281c4db88d77cf", "tree": "7039ee04def1237f3e58bd5d9898c8447147cfa8", "parents": [ "48cce5044d60feb32bef37fe883dd525f15a276c" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon May 04 14:02:09 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:09:58 2026 +0200" }, "message": "lsusb: return on short bLength in the class-specific descriptor dispatchers\n\nThe audio/video/MIDI/DFU class-specific descriptor dump entry points all\nshare a \"warn but fall through\" pattern on a too-short bLength:\n\n\tif (buf[1] !\u003d USB_DT_CS_INTERFACE)\n\t\tprintf(\" Warning: Invalid descriptor\\n\");\n\telse if (buf[0] \u003c 3)\n\t\tprintf(\" Warning: Descriptor too short\\n\");\n\t... desc_dump(dev, table, buf + 3, buf[0] - 3, indent);\n\nso a bLength of 2 underflows buf[0]-3 to UINT_MAX as the buf_len handed\nto desc_dump() (or dump_bytes() in the unknown-subtype tails), defeating\nevery per-field bounds check in the engine. The \"else\" makes it worse:\nthe caller\u0027s switch on bDescriptorType falls CS_DEVICE through to\nCS_INTERFACE, so a buf[1]\u003d\u003d0x21 takes the \"Invalid descriptor\" arm and\nskips the length check entirely.\n\nMake every dispatcher\u0027s short-descriptor check independent of the type\ncheck and return after the warning. Covers dump_audiocontrol_interface,\ndump_audiostreaming_interface, dump_audiostreaming_endpoint (which had\nno length check at all), dump_midistreaming_interface/_endpoint,\ndump_videocontrol_interface, dump_videocontrol_interrupt_endpoint,\ndump_videostreaming_interface, dump_dfu_interface, and\ndump_comm_descriptor (which opened with switch(buf[2]) before any length\ncheck at all, so a 2-byte CDC descriptor read the subtype byte one past\nlibusb\u0027s extra[] allocation).\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "48cce5044d60feb32bef37fe883dd525f15a276c", "tree": "46b2a380d05f69f75dd15af1ace4ec69792382f7", "parents": [ "11d70f11a4328994edff13f896e02efe2d7de720" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 03 13:50:48 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:09:58 2026 +0200" }, "message": "desc-dump: don\u0027t exit() on a device-supplied size_field value\n\nget_entry_size() and get_n_bytes_as_ull() both treat an out-of-range\nfield width (zero or \u003e8 bytes) as a programmer error in the descriptor\ntable and call exit(EXIT_FAILURE). When the width comes from a static\n.size that\u0027s correct, but when it comes from a .size_field reference\n(UAC1 bControlSize, MIDI bElCapsSize) the value is read straight from\nthe device and a malformed descriptor turns lsusb -v into a one-shot\nexit.\n\nReturn zero from get_entry_size() for a device-supplied zero width (the\nfield occupies no bytes on the wire, so there\u0027s nothing to render),\nguard the inferred-array-length division against that zero, and clamp\nget_n_bytes_as_ull() to the representable 8 bytes instead of bailing.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "11d70f11a4328994edff13f896e02efe2d7de720", "tree": "34701efc93eedc7f464ffb932f2867f911807787", "parents": [ "50d9ec4f4fa8ecb89a4a2651cda3560217612def" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 03 13:35:44 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:09:58 2026 +0200" }, "message": "lsusb: migrate the MIDIStreaming parsers onto the desc-dump table engine\n\ndump_midistreaming_interface() and dump_midistreaming_endpoint() were\nthe last of the audio-class dumpers still doing hand-rolled offset\narithmetic against device-supplied bLength / bNrInputPins / bElCapsSize\nfields. Move them onto the table-driven desc_dump() engine so they pick\nup its central per-field bounds checking instead of each open-coding it.\n\nFive descriptor tables (desc_midi_ms_*) replace ~150 lines of manual\nbuf[6+2*j] indexing. The interleaved baSourceID(n)/baSourcePin(n) pairs\nin the OUT Jack and Element descriptors are represented as a 2-byte\nDESC_SNOWFLAKE array entry with a callback that unpacks the pair — the\nengine has no native interleaved-array support, and this keeps the\nbounds check in the engine rather than reintroducing a hand-rolled walk.\nThe rendered output for those fields changes slightly (one combined\n\"baSource(n) 0x.... (ID i, Pin p)\" line instead of two separate\nbaSourceID/baSourcePin lines); lsusb -v output is for humans, not\nparsed.\n\nWhile here: the endpoint dumper now names bDescriptorSubtype 0x01 as\nMS_GENERAL (per midi10 §6.2.2) instead of \"Invalid\", and recognises 0x02\nas the midi20 GENERAL_2_0 form; and the bLength\u003c3 short-descriptor case\nreturns early instead of warning-and-continuing into a buf[0]-3\nunderflow.\n\nThis is the template for migrating the remaining hand-rolled descriptor\ndumpers (video, CCID, printer, DFU, ...) onto the same engine.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "50d9ec4f4fa8ecb89a4a2651cda3560217612def", "tree": "88902949e838a403f47f15877d173546e40d51b9", "parents": [ "f94053a7ae68436d0cd0b0ca99ee37ecd66ae610" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 03 08:46:31 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:09:58 2026 +0200" }, "message": "lsusb, usbmisc, usbhid-dump: zero-init buffers passed to libusb control transfers\n\nA device that returns fewer bytes than requested leaves the tail of the\nreceive buffer untouched, and several call sites print or parse past the\nactual transfer length on a short reply, echoing whatever happened to be\non the stack. usbmisc.c already zero-inits the main string buffer for\nexactly this reason; do the same for every other receive buffer handed\nto libusb_control_transfer / libusb_get_string_descriptor*.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f94053a7ae68436d0cd0b0ca99ee37ecd66ae610", "tree": "d4db40da762a56eec94a90adf5656eb39c38b53f", "parents": [ "d27e22b5c5b2e09b4c57b616d142570f2aa5bf3e" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 03 08:40:05 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:09:58 2026 +0200" }, "message": "sysfs: strip control characters from device-supplied string attributes\n\nThe manufacturer/product/serial sysfs attributes are device-supplied USB\nstring descriptors passed through verbatim by the kernel, so they can\ncontain terminal escape sequences. Replace C0 controls and DEL with a\nplaceholder in all three sysfs string readers (read_sysfs_prop in\nsysfs.c, read_sysfs_file_string in lsusb-t.c, sysfs_attr in usbreset.c)\nso callers never see escape bytes regardless of which front-end reads\nthem.\n\nusbreset.c is built standalone, so it keeps a local copy of the same\nfilter rather than linking the helper.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d27e22b5c5b2e09b4c57b616d142570f2aa5bf3e", "tree": "3047f1f3ed3733e8f59083dcfee75986413aa8e7", "parents": [ "7dc049a6735329ac63e0f55f72678a5dc29fc62f" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 02 12:58:10 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:09:58 2026 +0200" }, "message": "desc-dump: bound get_value_from_field() against descriptor length\n\nget_value_from_field() walked the descriptor definition to locate a\nnamed field and read its bytes, but never checked the computed offset\nagainst the actual descriptor length. A device that sends a truncated\nclass-specific descriptor (bLength shorter than the field being looked\nup) drives a heap over-read in get_n_bytes_as_ull().\n\nThread buf_len through get_value_from_field() and get_entry_size() (they\nrecurse into each other) and skip the read when the target field lies\npast the end of the supplied data, returning 0. desc_dump()\u0027s existing\nper-field length check then reports the truncation. All callers already\nhad buf_len in scope.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7dc049a6735329ac63e0f55f72678a5dc29fc62f", "tree": "09d49c9d04f340cee51a4afaff619564217df679", "parents": [ "0f285ff5af978dd1cfc519e67fb814f04f6785cd" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 02 12:49:07 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:09:58 2026 +0200" }, "message": "lsusb: bounds-check IPP printer capability walk against bLength\n\ndump_printer_device() loops bcdNumDescriptors (buf[3]) times, advancing\na cursor by 2 + buf[n+1] each iteration without ever comparing against\nbLength. Both the iteration count and the per-capability length come\nfrom the device, so a crafted descriptor can drive the cursor\narbitrarily far past the buffer.\n\nStop the walk as soon as the next capability header or body would lie\noutside bLength.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0f285ff5af978dd1cfc519e67fb814f04f6785cd", "tree": "68cb4968ddb76132b36fd93077464250b79e456e", "parents": [ "becb9120984cb563aa3b460ebc000f2f86b4b001" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 02 12:48:06 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:09:58 2026 +0200" }, "message": "lsusb: bounds-check MIDI OUT_JACK bNrInputPins against bLength\n\ndump_midistreaming_interface() only checked the fixed minimum (9) for a\nMIDI_OUT_JACK descriptor before looping bNrInputPins (buf[5]) times over\nbaSourceID/baSourcePin and then reading iJack at buf[6+2*buf[5]]. A\ndevice with a small bLength and a large bNrInputPins makes that walk\nhundreds of bytes past the descriptor.\n\nCompute the expected length from bNrInputPins and bail out of the case\nif bLength can\u0027t hold it.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "becb9120984cb563aa3b460ebc000f2f86b4b001", "tree": "07588820689969372284df57f8e97c6a85861e75", "parents": [ "84c5431fb98ef02cc0097f2a1ebc348b2619a417" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 21:18:02 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 31 14:09:58 2026 +0200" }, "message": "lsusb: bound the report-fetch loop in dump_hid_device() too\n\nCommit 086425d1e17b (\"lsusb: fix out-of-bounds reads in\ndump_hid_device() on short descriptors\") clamped the bNumDescriptors\nprint loop against bLength but missed the second, identical loop that\nwalks the same sub-descriptor array to fetch report descriptors. A\ndevice claiming a large bNumDescriptors with a short bLength still\nover-reads at buf[6+3*i] in that loop. Apply the same bound.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "84c5431fb98ef02cc0097f2a1ebc348b2619a417", "tree": "67402b593e7536f25014ca468d6906194bf519ea", "parents": [ "2f79c0812205b811a0d79968113c2d7cd39c9b32" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu May 07 07:24:05 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:06:11 2026 +0200" }, "message": "lsusb: strip control characters from the WebUSB landing-page URL\n\nget_webusb_url() fetches the URL descriptor with a vendor control\ntransfer and copies every byte \u003c 0x80 into the output string, which\nis then printed with %s. C0 control characters and DEL pass straight\nthrough, so a hostile device can embed terminal escape sequences in\nthe URL.\n\nReplace them with \u0027?\u0027 as the other device-string readers already do.\nThe path is gated on the WebUSB platform-capability GUID so the\nfuzzer never reached it; found by llvm-cov on the corpus replay.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2f79c0812205b811a0d79968113c2d7cd39c9b32", "tree": "ee91698e93f9fbfe85daae79e334c6cd7b706812", "parents": [ "a5a7d81208a430514a4dd9da7867b0a2dabe15d1" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 05 14:44:12 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:05:09 2026 +0200" }, "message": "usb-devices: fix default case in class_decode()\n\n\"*\") matches a literal asterisk, so any class code not in the table\nproduced an empty string instead of \"unk. \".\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a5a7d81208a430514a4dd9da7867b0a2dabe15d1", "tree": "16ae0fd24c2e2b0adad096a18257df403558f03b", "parents": [ "ff320379619076246ee62d9fbbe9c525fc842582" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 05 14:43:57 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:04:54 2026 +0200" }, "message": "usb-devices: use printf instead of echo for device-supplied strings\n\nprint_string() pipes manufacturer/product/serial through\n`tr -d \u0027\\000-\\037\\177\u0027` to strip control characters, then emits the\nresult with `echo`. POSIX leaves backslash handling in echo\nimplementation-defined; XSI-conformant shells (dash, busybox sh, ksh)\nexpand \\n, \\t, \\0NNN, \\c, \\e/\\033 in echo arguments. A device whose\nproduct string contains the two bytes \u0027\\\u0027 \u00270\u0027 \u00273\u0027 \u00273\u0027 (or \u0027\\\u0027 \u0027n\u0027)\ntherefore gets a real ESC or LF injected into the output after tr has\nalready run, defeating the sanitisation and allowing terminal-escape\nor fake-record injection on any system where /bin/sh is not bash.\n\nprintf \u0027%s\\n\u0027 does not interpret escapes in %s arguments.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ff320379619076246ee62d9fbbe9c525fc842582", "tree": "b53ab3636b082a42ec27df1b2213237182d47f5e", "parents": [ "071c497369b065cf79ec14acbf8f6b9d4ab7c156" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 05 13:36:33 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:04:13 2026 +0200" }, "message": "usbhid-dump: skip interfaces with bInterfaceNumber 0xff\n\nuhd_iface_valid() asserts number \u003c UINT8_MAX (0xff is reserved for the\n\"match any\" wildcard), but bInterfaceNumber is a device-supplied byte.\nA hostile or buggy HID device that reports interface number 255 makes\nevery uhd_iface_* call abort in any build with assertions enabled.\n\nJust skip such interfaces during enumeration; 0xff is not a valid\nbInterfaceNumber per the spec anyway.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "071c497369b065cf79ec14acbf8f6b9d4ab7c156", "tree": "28af546e4b1c1b139c62c84b10e6afb4e5f983c0", "parents": [ "9bb8d8be87d81d07d74771b34750b6cbf98dc12d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon May 04 18:31:31 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:03:37 2026 +0200" }, "message": "lsusb: bounds-check the BOS device-capability walk\n\nThe outer loop in dump_bos_descriptor() checked bLength \u003e\u003d 3 but not\nbLength \u003c\u003d remaining, so a sub-descriptor claiming more bytes than are\nleft in the malloc\u0027d BOS buffer over-read it before dispatching.\n\ndump_usb2_device_capability_desc() had no bLength check at all and\nread buf[3..6] unconditionally. dump_ssp_device_capability_desc()\nchecked bLength \u003e\u003d 12 for the fixed header but then walked up to 32\nfour-byte sublink-speed attributes keyed on the device-supplied count\nin buf[4] without checking they fit.\n\nThe remaining capability dumpers already return on short bLength.\n\nFound by extending the libFuzzer shim to feed\nlibusb_control_transfer() responses from the fuzz input (next commit).\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9bb8d8be87d81d07d74771b34750b6cbf98dc12d", "tree": "baedd9ccc7f2b155595e2e1040adf89994192fdf", "parents": [ "f2def8fa999c20178108d1a2ddaf2b9a35e21367" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon May 04 18:05:04 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:03:14 2026 +0200" }, "message": "desc-defs: fix off-by-one in UAC1 wFormatTag string lookup\n\nThe Type II and Type III branches of the wFormatTag snowflake renderer\nuse \u003c\u003d where the Type I branch correctly uses \u003c, so wFormatTag values\n0x1003 and 0x2007 index one past the end of audio_data_format_type_ii[]\nand audio_data_format_type_iii[] respectively. The resulting wild\npointer is handed to printf(\"%s\").\n\nFound by the libFuzzer harness (global-buffer-overflow at ~3.3M execs).\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f2def8fa999c20178108d1a2ddaf2b9a35e21367", "tree": "e3a26af21952a773c21824689d77aae1a75b5207", "parents": [ "78dbab3051a7523bf7cd9f11a869983475ed18b9" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 03 09:17:15 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:02:51 2026 +0200" }, "message": "lsusb: don\u0027t loop forever in find_otg() on a zero-bLength sub-descriptor\n\nA device that places a sub-descriptor with bLength \u003d\u003d 0 (or 1) anywhere\nin a config / interface / endpoint extra[] region makes find_otg() spin:\nthe existing buf[0] \u003e buflen guard does not catch a zero step. Bail out\non bLength \u003c 2 the same way the other extra[] walkers already do.\n\nFound by the new fuzz harness within seconds of its first run.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "78dbab3051a7523bf7cd9f11a869983475ed18b9", "tree": "8ef486a5b900fd16ea6f53e9b4aab379ac3fdb26", "parents": [ "63034aee641928ca87e505bfc5349a7cf9f811b9" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 03 08:41:31 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:01:39 2026 +0200" }, "message": "usbmisc, usb-devices: strip control characters from device-supplied strings\n\nA USB device controls every byte of its string descriptors, so the\nmanufacturer/product/serial values that lsusb prints with %s and that\nusb-devices echoes can carry terminal escape sequences (CSI title-set,\ncursor moves, bracketed-paste abuse, etc.).\n\nFilter C0 controls and DEL out of get_dev_string()\u0027s result so every\nlsusb -v string-descriptor lookup is safe regardless of which dump_*\nroutine prints it, and pipe the sysfs string attributes through tr in\nusb-devices\u0027 print_string. Together with the earlier sysfs-reader and\nlsusb.py changes this closes the device-supplied-string output path\nacross all five front-ends.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "63034aee641928ca87e505bfc5349a7cf9f811b9", "tree": "427d31fa9f0cba055173a7be602c144676c0c0ef", "parents": [ "10aa78431e261a351b952e7a76855e3d87735db6" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 02 12:54:54 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:01:32 2026 +0200" }, "message": "usbreset: refuse ambiguous selectors that match more than one device\n\nfind_device() returned the first readdir-order match when selecting by\nproduct name, serial, or VID:PID. All of those are device-supplied, so\na hostile device can name itself to collide with a string an admin\nhabitually resets and steer USBDEVFS_RESET at the wrong target.\n\nKeep scanning after the first match; if a second device matches, print\nan error and return no device so the caller falls through to the\n\"No such device\" path. The kernel-assigned BBB/DDD form remains the\nunambiguous selector.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "10aa78431e261a351b952e7a76855e3d87735db6", "tree": "ffa60d5223b382217925629ed1ecf274a2cbc8e4", "parents": [ "4521cf79fb88fa08dec1e76f051bcbb2990fa85d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 02 12:50:02 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:01:07 2026 +0200" }, "message": "lsusb.py: strip control characters from device-supplied sysfs strings\n\nmanufacturer/product/serial come straight from the device\u0027s string\ndescriptors via sysfs and are printed verbatim. A device that puts\nANSI/CSI escape sequences in those strings can clear the screen, move\nthe cursor, retitle the terminal, or otherwise spoof what the user\nsees when they run lsusb.py.\n\nReplace any non-printable character returned from a sysfs attribute\nwith \u0027?\u0027 so device-supplied text is rendered as inert data.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4521cf79fb88fa08dec1e76f051bcbb2990fa85d", "tree": "890369b92ec0a5180675a278e0957f11ea2c6eab", "parents": [ "77a8734ae8ad3fdc7179ed6555999c2ff3a5cf0b" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 02 12:49:40 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:00:39 2026 +0200" }, "message": "lsusb: bounds-check UVC INPUT_TERMINAL bControlSize against bLength\n\nFor an ITT_CAMERA INPUT_TERMINAL, dump_videocontrol_interface() adds\nthe device-supplied bControlSize (buf[14]) to n and then reads the\nbmControls bitmap from buf[8+n-i-1]. The existing too-short check ran\nbefore bControlSize was known and only warned, so a large bControlSize\nwith a small bLength reads past the descriptor.\n\nBail out on the existing minimum check, and re-check after adding\nbControlSize.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "77a8734ae8ad3fdc7179ed6555999c2ff3a5cf0b", "tree": "1ca50c8aacd24105fa82f2a57462302b2fa2ffdc", "parents": [ "6d389e79a5962758561ffe071b6ee9ebec027e51" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 02 12:48:44 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:00:36 2026 +0200" }, "message": "lsusb: bounds-check MIDI ELEMENT bNrInputPins/bElCapsSize against bLength\n\nThe MIDI ELEMENT descriptor dump only checked the fixed minimum (12)\nbefore walking bNrInputPins (buf[4]) source-pin pairs and then reading\nthe trailing bNrOutputPins/bElCapsSize/bmElementCaps/iElement fields at\noffsets derived from buf[4] and bElCapsSize. With a small bLength and\neither of those device-supplied counts large, the dump reads past the\ndescriptor.\n\nCompute the expected length from bNrInputPins, bail out if bLength is\nshort, and re-check once bElCapsSize is known.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6d389e79a5962758561ffe071b6ee9ebec027e51", "tree": "9171540b9a14991e6b37420bba09c1e6d326160f", "parents": [ "93e6a9e15726592aaa7e34ebae08c83768a4302f" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 02 08:10:37 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 17:00:32 2026 +0200" }, "message": "lsusb: fix wrong byte printed for CCID bClassEnvelope\n\nThe non-echo branch of the bClassEnvelope dump emits buf[48]\n(bClassGetResponse) instead of buf[49], so the displayed value is\nwrong whenever bClassEnvelope is anything other than 0xFF.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "93e6a9e15726592aaa7e34ebae08c83768a4302f", "tree": "4bc9193e8183f1bb4abf58fcee2941f71b67658d", "parents": [ "ac5b319def494e74f71cc902c9d7c9fb799a8189" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 12 10:41:12 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:53:05 2026 +0200" }, "message": "lsusb: fix unsigned integer underflow in dump_bytes calls for short descriptors\n\nMultiple descriptor parsing functions have default/error paths that call\ndump_bytes(buf+N, buf[0]-N) to dump unknown descriptor content. When\nbuf[0] \u003c N, the unsigned subtraction wraps to a value near UINT_MAX,\ncausing dump_bytes() to attempt reading ~4GB of data, resulting in a\ncrash or massive OOB read.\n\nThis is reachable when a malicious USB device provides a 2-byte\ndescriptor (the minimum accepted by callers) with an unrecognized\nsubtype. The affected functions are:\n\n- dump_audiocontrol_interface (buf+3, buf[0]-3)\n- dump_audiostreaming_interface (buf+3, buf[0]-3)\n- dump_midistreaming_interface (buf+3, buf[0]-3)\n- dump_videocontrol_interface (buf+3, buf[0]-3)\n- dump_videostreaming_interface (buf+3, buf[0]-3)\n\nAdd a guard check `if (buf[0] \u003e N)` before each dump_bytes call.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ac5b319def494e74f71cc902c9d7c9fb799a8189", "tree": "13ba9bcd55d5d340bbf0fceacfb69e66cd33bb88", "parents": [ "d6fa60e692687a56aedf1487ccbd015c4c48a38d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 06:10:57 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:52:15 2026 +0200" }, "message": "lsusb: fix OOB read in FORMAT_STREAM_BASED descriptor parsing\n\nIn dump_videostreaming_interface() FORMAT_STREAM_BASED (0x12), the\ncheck `buf[0] !\u003d 24` warns about incorrect length but continues to\naccess buf[3], get_guid(\u0026buf[4]) (reads buf[4..19]), and buf[20].\n\nIf the descriptor is shorter than 21 bytes, get_guid() reads up to\n16 bytes past the descriptor end. Change the check to verify\nbuf[0] \u003e\u003d 24 and break on short descriptors.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d6fa60e692687a56aedf1487ccbd015c4c48a38d", "tree": "d083a209c586fad90575033a9aeb3909326228c1", "parents": [ "56c770ea37ca2d6e6eea76b481a4ccb6b633b5c5" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 06:10:21 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:52:15 2026 +0200" }, "message": "lsusb: zero hub descriptor buffer to prevent reading uninitialized data\n\nIn do_hub(), the hub descriptor buffer is stack-allocated but not\ninitialized. The USB control transfer may return fewer bytes than the\nbuffer size (only checked \u003e\u003d 9). dump_hub() then accesses bytes up to\np[12] for USB 3.0 hubs (offset\u003d10, l up to 3) or p[12] for USB 2.0\nhubs (offset\u003d7, l up to 3, plus PortPwrCtrlMask).\n\nWhen the control transfer returns fewer bytes (e.g., 9 or 10),\ndump_hub() reads uninitialized stack data, which is undefined behavior\nand could leak sensitive stack contents to the terminal.\n\nZero-initialize the buffer to ensure all bytes have defined values\nregardless of how many the control transfer actually fills.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "56c770ea37ca2d6e6eea76b481a4ccb6b633b5c5", "tree": "25feb339ef226ef7e72252b4e85f6933ec6d302c", "parents": [ "9e2b2ba036740ac44b07d18f1472eb8144bfdec7" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 06:09:11 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:52:15 2026 +0200" }, "message": "lsusb: fix OOB read in FORMAT_MPEG2TS descriptor on short descriptors\n\nIn dump_videostreaming_interface() FORMAT_MPEG2TS, the code warns when\nbuf[0] \u003c 7 (minimum format length) but continues to access buf[3]\nthrough buf[6]. Convert the warning to break out of the switch.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "9e2b2ba036740ac44b07d18f1472eb8144bfdec7", "tree": "4353c5226c8516da6766dd505a8f2ea503ef4b4b", "parents": [ "7b7151a216b9d2b6d948f9e9c708c3a5f7983c69" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 06:08:49 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:52:15 2026 +0200" }, "message": "lsusb: fix OOB read in STILL_IMAGE_FRAME compression pattern loop\n\nIn dump_videostreaming_interface() STILL_IMAGE_FRAME, after the image\nsize patterns are validated, bNumCompressionPatterns (m) is read and\nthe check `buf[0] \u003c 6+4*n+m` warns but continues. The subsequent loop\n`for (i \u003d 0; i \u003c m; i++) ... buf[6+4*n+i]` reads past the descriptor\nwhen m exceeds the available data.\n\nConvert the warning to break out of the switch.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7b7151a216b9d2b6d948f9e9c708c3a5f7983c69", "tree": "23f76686336538c0407dfacb17eb4886c1c27e0f", "parents": [ "7c80eed3040d69e2451f03f6e161f1fe5ce16ac6" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 06:08:32 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:52:15 2026 +0200" }, "message": "lsusb: fix OOB reads in video INPUT_HEADER and OUTPUT_HEADER data loops\n\nIn dump_videostreaming_interface(), INPUT_HEADER and OUTPUT_HEADER both\nhave variable-length bmaControls arrays indexed by buf[3] (bNumFormats)\nand buf[12]/buf[8] (bControlSize). The loops access buf[13+i*n] and\nbuf[9+i*n] respectively.\n\nAfter the initial minimum-length early break was added, a secondary\ncheck `buf[0] \u003c 13+p*n` / `buf[0] \u003c 9+p*n` warns but continues. Since\np and n come from the descriptor (p up to 255, n up to 255), the loops\ncan read up to buf[13+255*255] \u003d buf[65,048] past the buffer.\n\nConvert both warnings to break out of the switch.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7c80eed3040d69e2451f03f6e161f1fe5ce16ac6", "tree": "aeaf7791a9a34a63675bf791030d852a28180395", "parents": [ "4f991a67bdc0bf8ffdb99b5790ecd1ca73872209" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 05:59:56 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:52:15 2026 +0200" }, "message": "lsusb: fix remaining OOB reads in video descriptor warn-and-continue paths\n\nThree video descriptor subtypes in dump_videocontrol_interface() still\nhad \"warn but continue\" patterns that could cause OOB reads:\n\n- HEADER (0x01): after verifying buf[0] \u003e\u003d 12, the secondary check\n buf[0] \u003c 12+n (where n\u003dbuf[11]) warned but continued, allowing the\n baInterfaceNr loop to read buf[12+i] past the descriptor end.\n\n- INPUT_TERMINAL (0x02): the camera-type check buf[0] \u003c 8+n (n\u003d7 for\n camera terminals) warned but continued to access buf[8..14].\n\n- ENCODING_UNIT (0x07): accessed buf[3..12] and called get_dev_string\n with buf[5] before checking buf[0] \u003e\u003d 13.\n\nConvert all three to break out of the switch after the warning.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4f991a67bdc0bf8ffdb99b5790ecd1ca73872209", "tree": "0780df32b3307461e77e84a79d7e1a2f83d4e87d", "parents": [ "553db43a7f125c217e2fdbab60255ec08048ce3e" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 05:58:45 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:52:15 2026 +0200" }, "message": "lsusb: fix remaining OOB read in MIDI_OUT_JACK initial fields\n\nThe previous fix for MIDI_OUT_JACK added bounds checking for the\nvariable-length input pins loop, but the initial \"buf[0] \u003c 9\" warning\nstill allowed execution to continue and access buf[3], buf[4], and\nbuf[5] (bJackType, bJackID, bNrInputPins) on short descriptors.\n\nConvert the warning to break out of the switch.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "553db43a7f125c217e2fdbab60255ec08048ce3e", "tree": "d2aaae76f1be39560d8dd99a212e3dacb1559628", "parents": [ "e18f2e02a64cc4c118e8e1a2c16c6174d45acdff" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 05:58:28 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:52:15 2026 +0200" }, "message": "lsusb: fix OOB reads in video FRAME descriptor parsing\n\nIn dump_videostreaming_interface() for FRAME_UNCOMPRESSED (0x05),\nFRAME_MJPEG (0x07), and FRAME_FRAME_BASED (0x11):\n\n1. buf[n] (bFrameIntervalType at offset 21 or 25) is accessed before\n any bounds check. If the descriptor is shorter than n+1 bytes, this\n is an out-of-bounds read.\n\n2. After the \"too short\" warning, execution continues to access buf[3]\n through buf[25+] and loop over frame interval entries, all of which\n can be out of bounds.\n\nAdd an early check for the minimum fixed-size portion (n+1 bytes), then\nconvert the computed-length warning to also break.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e18f2e02a64cc4c118e8e1a2c16c6174d45acdff", "tree": "9285353e566b5745e330f998845c79db8a0bec4e", "parents": [ "659df3e9f2db133bc619c8590a72ab8f41090a31" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 05:58:06 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:52:15 2026 +0200" }, "message": "lsusb: fix OOB reads in video streaming format descriptors\n\nIn dump_videostreaming_interface(), three descriptor subtypes warn about\nshort descriptors but continue to access out-of-bounds buffer indices:\n\n- FORMAT_UNCOMPRESSED/FORMAT_FRAME_BASED (0x04/0x10): access buf[3..26]\n (or buf[27]) when buf[0] \u003c 27/28. The guidFormat field alone requires\n reading 16 bytes at buf[5..20].\n\n- FORMAT_MJPEG (0x06): accesses buf[3..10] when buf[0] \u003c 11.\n\n- COLORFORMAT (0x0d): accesses buf[3..5] when buf[0] \u003c 6.\n\nConvert all three warnings to break out of the switch.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "659df3e9f2db133bc619c8590a72ab8f41090a31", "tree": "1f2c6bb103b31b29b0b9b8315e79f30f8a1f519f", "parents": [ "0b2b5ce575a818b6e5211a7dbbf1262656c3ef6b" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 05:57:38 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:50:52 2026 +0200" }, "message": "lsusb: fix OOB read in dump_videocontrol_interrupt_endpoint()\n\nThe function warns when buf[0] \u003c 5 but continues to access buf[3] and\nbuf[4] for wMaxTransferSize. A malicious USB device providing a short\nVideoControl interrupt endpoint descriptor causes an out-of-bounds read.\n\nReturn early after the \"too short\" warning.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0b2b5ce575a818b6e5211a7dbbf1262656c3ef6b", "tree": "df6e1094609edd65b9164e16bc74101153fbc85a", "parents": [ "674a28a6a7efbbb531618b8afba3947c6f60aab1" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 05:57:26 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:50:52 2026 +0200" }, "message": "lsusb: fix OOB reads in MIDI HEADER and MIDI_IN_JACK descriptor parsing\n\nIn dump_midistreaming_interface():\n\n- MIDI HEADER (0x01): accesses buf[3..6] after warning buf[0] \u003c 7\n without breaking. A short descriptor causes OOB reads for bcdADC\n and wTotalLength fields.\n\n- MIDI_IN_JACK (0x02): calls get_dev_string(dev, buf[5]) and accesses\n buf[3..5] after warning buf[0] \u003c 6 without breaking.\n\nConvert both warnings to break out of the switch.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "674a28a6a7efbbb531618b8afba3947c6f60aab1", "tree": "405e4da04749f692ba7671c3df7fc15ccb5566b0", "parents": [ "086425d1e17b67a19be3621569e7b11d13384341" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Apr 05 05:57:12 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:50:52 2026 +0200" }, "message": "lsusb: fix OOB reads in UAC2 FORMAT_TYPE descriptor parsing\n\nIn dump_audiostreaming_interface() for USB_AUDIO_CLASS_2, all four\nFORMAT_TYPE subtypes warn about short descriptors but continue\nexecution, accessing buffer indices past the descriptor length:\n\n- FORMAT_TYPE_I/III: access buf[4..5] when buf[0] \u003c 6\n- FORMAT_TYPE_II: access buf[4..7] when buf[0] \u003c 8\n- FORMAT_TYPE_IV: accesses buf[3] when buf[0] \u003c 4\n\nConvert all warnings to break out of the switch to prevent\nout-of-bounds reads from malicious USB device descriptors.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "086425d1e17b67a19be3621569e7b11d13384341", "tree": "cf83fafcab58172712354dc220fc7daa38ecaa13", "parents": [ "7a7a3b0e8354014bf188fff91cb7506f90308009" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:24:43 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:50:52 2026 +0200" }, "message": "lsusb: fix out-of-bounds reads in dump_hid_device() on short descriptors\n\ndump_hid_device() has two issues with short descriptors:\n\n1. When buf[0] \u003c 6, the code accesses buf[2] through buf[5] before any\n length check, since the \"too short\" warning was in an else-if that\n only triggered when buf[1] \u003d\u003d LIBUSB_DT_HID. Add an unconditional\n minimum length check of 6 bytes.\n\n2. The loop iterating buf[5] times accesses buf[6+3*i], buf[7+3*i],\n buf[8+3*i] without bounds checking against buf[0]. When\n bNumDescriptors (buf[5]) is large but the descriptor is short,\n these reads go out of bounds. Add a bounds check in the loop\n condition.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7a7a3b0e8354014bf188fff91cb7506f90308009", "tree": "14eab114b8cae485bd28dfcafa59ec6f24b3b535", "parents": [ "8bc561e8aabb03cd4c5006ebb05549e85d5cd262" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:24:16 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:50:52 2026 +0200" }, "message": "lsusb: add missing length check in dump_association()\n\ndump_association() accesses buf[4] through buf[7] without verifying the\ndescriptor is at least 8 bytes. The Interface Association Descriptor is\ndefined as 8 bytes per the USB spec, but a malicious device could\nprovide a shorter one.\n\nThe function is called from multiple places (dump_config, dump_endpoint,\ndump_altsetting) which only verify buf[0] \u003e\u003d 2 before dispatching.\n\nAdd a minimum length check and return early when too short.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8bc561e8aabb03cd4c5006ebb05549e85d5cd262", "tree": "b35a78a6f0b8d3da386e944cf4e46204880f0be3", "parents": [ "44494e921a6c3d5b51c6ac479760bb9c42f0fea2" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:23:33 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:50:52 2026 +0200" }, "message": "lsusb: fix OOB read in dump_dfu_interface on short descriptors\n\ndump_dfu_interface() prints a \"descriptor too short\" warning when\nbuf[0] \u003c 7 but continues to access buf[2] through buf[6]. The warning\nwas in an else-if branch, meaning it only triggered when\nbuf[1] \u003d\u003d USB_DT_CS_DEVICE, and even then execution continued past\nthe warning.\n\nA malicious USB device providing a short DFU descriptor triggers\nout-of-bounds reads. Change the length check to an unconditional\nearly return when the descriptor is too short.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "44494e921a6c3d5b51c6ac479760bb9c42f0fea2", "tree": "5ab6de66caaa9c611aeaf9f36a9f7dfa1df9e8a4", "parents": [ "bba3929f219285ac22f514c94c5c87b5c436d139" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:23:18 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:50:52 2026 +0200" }, "message": "lsusb: add missing length checks in dump_security and dump_encryption_type\n\ndump_security() accesses buf[0] through buf[4] (5 bytes) and\ndump_encryption_type() accesses buf[0] through buf[4] (5 bytes),\nboth without verifying buf[0] \u003e\u003d 5.\n\nA malicious USB device providing short security or encryption type\ndescriptors causes out-of-bounds reads. Add minimum length checks\nand return early when too short.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bba3929f219285ac22f514c94c5c87b5c436d139", "tree": "83121ae10d5b10f67d7b464191b0b23eb49182bf", "parents": [ "5f8af529cce356ceefe70b5fc7cb01ada014c677" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:23:01 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:50:52 2026 +0200" }, "message": "lsusb: add missing length checks in dump_wire_adapter and dump_rc_interface\n\ndump_wire_adapter() accesses buf[0] through buf[13] (14 bytes) without\nany descriptor length validation. dump_rc_interface() accesses buf[0]\nthrough buf[3] without checking buf[0] \u003e\u003d 4.\n\nA malicious USB device providing short descriptors for either type\ncauses out-of-bounds reads. Add minimum length checks and return early\nwhen the descriptor is too short.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5f8af529cce356ceefe70b5fc7cb01ada014c677", "tree": "ca4daf4748098bc83c715478eb4f69cf982e9fc2", "parents": [ "ce7db3868f03649499f96888d982ce0b35f74550" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:22:45 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:50:52 2026 +0200" }, "message": "lsusb: fix out-of-bounds reads in IPP printer descriptor parsing\n\ndump_printer_device() iterates through sub-descriptors using buf[3] as\nthe count and buf[n+1] to advance the offset, without any bounds\nchecking against buf[0] (the total descriptor length). Multiple buffer\naccesses (buf[n], buf[n+1], buf[n+2..n+5]) can read past the end of\nthe descriptor.\n\nA malicious USB device providing a short descriptor with a large\nbcdNumDescriptors value or large sub-descriptor lengths causes\nout-of-bounds reads.\n\nAdd bounds checks: verify minimum descriptor length, check n+2 fits\nbefore each iteration, and check n+6 fits before accessing basic\ncapability fields.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ce7db3868f03649499f96888d982ce0b35f74550", "tree": "94458651fb6e134a0b6b7a29f39ebcc3c95a0852", "parents": [ "707426ee3504c0e55b472e14c2f3e8d1fa02d2a1" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:22:26 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:48:56 2026 +0200" }, "message": "lsusb: fix OOB reads in audio FORMAT_SPECIFIC descriptor parsing\n\nIn dump_audiostreaming_interface() case 0x03 (FORMAT_SPECIFIC), three\n\"descriptor too short\" warnings are printed without breaking:\n\n- The outer check (buf[0] \u003c 5) warns but continues to access buf[3]\n and buf[4] for the format tag.\n\n- MPEG subtype (buf[0] \u003c 8) warns but continues to access buf[5]\n through buf[7].\n\n- AC-3 subtype (buf[0] \u003c 10) warns but continues to access buf[5]\n through buf[9].\n\nA malicious USB device providing short FORMAT_SPECIFIC descriptors\ntriggers out-of-bounds reads. Convert warnings to break out of the\nswitch instead of falling through to buffer accesses.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "707426ee3504c0e55b472e14c2f3e8d1fa02d2a1", "tree": "6fbe66c7229e842f187910db7822b64d5768bd6f", "parents": [ "dcadb07e175c5965d229d35b37466ff258ceb405" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:22:02 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:48:49 2026 +0200" }, "message": "lsusb: fix out-of-bounds read in SuperSpeedPlus capability descriptor\n\nIn dump_ssp_device_capability_desc(), the loop iterates up to\n(buf[4] \u0026 0x1f) + 1 times (max 32), accessing 4 bytes at\nbuf[12 + i*4]. The maximum offset is buf[139], but the only bounds\ncheck is buf[0] \u003e\u003d 12.\n\nA malicious USB device can provide a short descriptor with a large\nSublink Speed Attribute count, causing reads up to 127 bytes past the\nend of the descriptor buffer.\n\nAdd a bounds check in the loop condition to verify each 4-byte\nattribute fits within the descriptor length.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dcadb07e175c5965d229d35b37466ff258ceb405", "tree": "b1e061eae10267f0bef83cf8159d996a165acea0", "parents": [ "b49076f22d07abc507b65d763dfc6b84e17fcf43" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:06:59 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:48:33 2026 +0200" }, "message": "lsusb: fix OOB reads in UAC1 audio FORMAT_TYPE descriptor parsing\n\nIn dump_audiostreaming_interface() for USB_AUDIO_CLASS_1, FORMAT_TYPE_I,\nII, and III subtypes print a \"descriptor too short\" warning but continue\nexecuting, accessing buffer elements beyond the descriptor length.\n\nFor FORMAT_TYPE_I and III, buf[7] (bSamFreqType) controls a loop that\naccesses buf[8+3*i] through buf[10+3*i]. When buf[7] is large but the\ndescriptor is short, these reads go out of bounds.\n\nFor FORMAT_TYPE_II, buf[8] (bSamFreqType) similarly controls a loop\naccessing buf[9+3*i] through buf[11+3*i]. Additionally, buf[8] itself\nis accessed without first checking the minimum length of 9 bytes.\n\nConvert all \"descriptor too short\" warnings to break out of the switch\ninstead of falling through to the buffer accesses.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b49076f22d07abc507b65d763dfc6b84e17fcf43", "tree": "fd7dd6eeb98ac40d8e8ed7fb407beae1fc18cc9d", "parents": [ "8953d1f48199ce7a25e307be3da746dd9677790b" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:06:24 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:48:22 2026 +0200" }, "message": "lsusb: fix undefined behavior in convert_le_u32() signed shift\n\nbuf[3] is promoted from unsigned char to int (signed) before the left\nshift. When buf[3] \u003e\u003d 128, shifting left by 24 produces a value that\nexceeds INT_MAX, which is undefined behavior per C99/C11 6.5.7p4.\n\nWhile this works on all mainstream compilers, sanitizers flag it and\noptimizing compilers are permitted to exploit UB in surprising ways.\n\nCast buf[3] to unsigned int before shifting to ensure defined behavior.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8953d1f48199ce7a25e307be3da746dd9677790b", "tree": "911f901e1dab250b9fe962ad283cd0a7a0f47b90", "parents": [ "4ff5ad804e22a5d82c197a0a2bf44669799f12ed" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:04:53 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:48:18 2026 +0200" }, "message": "lsusb: fix out-of-bounds reads in video terminal and selector descriptors\n\nIn dump_videocontrol_interface(), three descriptor subtypes access buffer\nfields before verifying the descriptor is long enough:\n\n- INPUT_TERMINAL (0x02): accesses buf[7] for get_dev_string() before\n checking buf[0] \u003e\u003d 8.\n\n- OUTPUT_TERMINAL (0x03): accesses buf[8] for get_dev_string() before\n checking buf[0] \u003e\u003d 9.\n\n- SELECTOR_UNIT (0x04): reads buf[4] to compute p, then accesses\n buf[5+p] for get_dev_string() with only a warning (no break) when\n the descriptor is too short.\n\nA malicious USB device providing short descriptors for any of these\ntypes triggers out-of-bounds reads. Move the bounds checks before the\ndependent buffer accesses and break out early when too short.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4ff5ad804e22a5d82c197a0a2bf44669799f12ed", "tree": "27c2df3f5d20d33e4c2c3969ca59b25a84990800", "parents": [ "64f7edf36baf6f5205b9720204ac852001138baf" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:04:14 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:48:13 2026 +0200" }, "message": "lsusb: fix out-of-bounds reads in video PROCESSING_UNIT descriptor\n\nIn dump_videocontrol_interface() case 0x05 (PROCESSING_UNIT), buf[7]\n(bControlSize) is read and used to compute offset buf[8+n] for\nget_dev_string() before checking whether the descriptor is long enough.\n\nA malicious USB device providing a large bControlSize with a short\ndescriptor causes buf[8+n] to read out of bounds.\n\nMove the bounds checks before the dependent buffer accesses and break\nout early if the descriptor is too short.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "64f7edf36baf6f5205b9720204ac852001138baf", "tree": "86e455afb0e83fa2c29b46bfb0c84aa431bca9be", "parents": [ "28f7309a447cde318e5ec960d8b47716b98b2aa7" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:03:58 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:48:11 2026 +0200" }, "message": "lsusb: fix out-of-bounds reads in video INPUT_HEADER and OUTPUT_HEADER\n\nIn dump_videostreaming_interface(), INPUT_HEADER accesses buf[12]\n(bControlSize) before verifying the descriptor is at least 13 bytes.\nOUTPUT_HEADER similarly accesses buf[8] before verifying at least 9\nbytes.\n\nA malicious USB device providing a short descriptor triggers\nout-of-bounds reads when these fields are accessed.\n\nAdd minimum length checks and break out early before accessing the\nfields that depend on the descriptor being long enough.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "28f7309a447cde318e5ec960d8b47716b98b2aa7", "tree": "5c12ea7b0e4886fe6548f482d8d297226102bfd1", "parents": [ "72aa5f7b8e04b1bb20cd6676fe3ec2558f3e2016" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:03:10 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:46:16 2026 +0200" }, "message": "lsusb: fix wrong variable in FORMAT_TYPE_II descriptor length calculation\n\nIn dump_audiostreaming_interface() FORMAT_TYPE_II, the expected descriptor\nlength is computed as `buf[8] ? (buf[7]*3+9) : 15`. This incorrectly\nuses buf[7] (high byte of wSamplesPerFrame) instead of buf[8]\n(bSamFreqType) for the number of discrete sampling frequencies.\n\nFORMAT_TYPE_I and III correctly use buf[7] for their frequency count\nbecause their bSamFreqType is at offset 7. But FORMAT_TYPE_II has\nbSamFreqType at offset 8, so the calculation should be buf[8]*3+9.\n\nThis bug causes the expected length to be computed from unrelated data,\npotentially masking \"descriptor too short\" warnings and causing the\nsubsequent loop to read out of bounds when the real frequency count\n(buf[8]) differs from buf[7].\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "72aa5f7b8e04b1bb20cd6676fe3ec2558f3e2016", "tree": "f2f7244c5f57726fd704853b64d86029c9789501", "parents": [ "3aa55446f497ee6c4b092c277dabbf0d007ff31e" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 20:00:06 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:45:59 2026 +0200" }, "message": "lsusb-t: fix buffer handling in read_sysfs_file_string()\n\nread_sysfs_file_string() reads up to \u0027len\u0027 bytes but only processes the\ndata when r \u003c len, discarding valid data when the read fills the entire\nbuffer (r \u003d\u003d len). This silently drops attribute values that exactly fill\nthe buffer.\n\nAdditionally, when r \u003d\u003d len, buf[r] would write one byte past the end of\nthe buffer (off-by-one).\n\nFix by reading at most len-1 bytes to always leave room for null\ntermination, and accept all positive read results.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3aa55446f497ee6c4b092c277dabbf0d007ff31e", "tree": "e857b22c7caaeeb0f8ada7e0d955cfcd4b5e9f4d", "parents": [ "1fb9a15613d705eb4145f229c54956fa3f53f3f0" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 19:59:52 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:45:51 2026 +0200" }, "message": "lsusb: fix out-of-bounds read in STILL_IMAGE_FRAME descriptor parsing\n\nIn dump_videostreaming_interface() case 0x03 (STILL_IMAGE_FRAME), buf[4]\nis used to compute n (number of image size patterns), then buf[5+4*n] is\naccessed to read m (number of compression patterns). Both accesses occur\nbefore the bounds check against buf[0].\n\nA malicious USB device can provide a large bNumImageSizePatterns value,\ncausing buf[5+4*n] to read far past the descriptor buffer.\n\nAdd progressive bounds checks before each dependent buffer access and\nbreak out early when the descriptor is too short.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1fb9a15613d705eb4145f229c54956fa3f53f3f0", "tree": "bddeedff6fb7267c4fc116fcd2920c62a520997c", "parents": [ "f5da0099be2c26317f7fab491007850fe9ff59e0" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 19:59:35 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:45:47 2026 +0200" }, "message": "lsusb: fix out-of-bounds read in MIDI streaming endpoint descriptor\n\nIn dump_midistreaming_endpoint(), buf[3] (bNumEmbMIDIJack) is used as a\nloop count to access buf[4+j] without checking against the descriptor\nlength buf[0]. A malicious USB device can set bNumEmbMIDIJack to a large\nvalue, causing reads past the descriptor buffer.\n\nAdd a bounds check in the loop condition to stop before exceeding the\ndescriptor length.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f5da0099be2c26317f7fab491007850fe9ff59e0", "tree": "09ac710c0ae9d49ccddad7aff112fe1166ea700c", "parents": [ "98466e4abd2fdf2edd6a43a39233950d03157d9d" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 19:59:19 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:45:39 2026 +0200" }, "message": "lsusb: replace sprintf() with snprintf() in get_guid()\n\nget_guid() uses sprintf() to format a GUID into a 39-byte static buffer.\nWhile the current format string produces exactly 38 characters plus null,\nusing snprintf() with sizeof(guid) provides defense-in-depth against any\nfuture format string changes that could overflow the buffer.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "98466e4abd2fdf2edd6a43a39233950d03157d9d", "tree": "6903ab9b03be8467fbb10d6025a71bf429a698e3", "parents": [ "3548559173b1ac503a2d9c50dbae29f5b8851ff4" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 19:59:04 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:43:55 2026 +0200" }, "message": "lsusb: fix out-of-bounds read in HID report descriptor parsing\n\nIn dump_report_desc(), the inner loop accesses b[i+1+j] for j up to\nbsize-1 without checking that i+1+bsize \u003c\u003d l. If the report descriptor\ndata is truncated (a malicious or buggy device could provide an\nincomplete item at the end of the descriptor), this reads past the end\nof the buffer.\n\nAdd a bounds check after computing bsize to detect truncation and break\nout of the parsing loop with a warning.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3548559173b1ac503a2d9c50dbae29f5b8851ff4", "tree": "8de07ca03daf65a29a3835fdfefc0ca244a5b40a", "parents": [ "b5442f6976e135b0b0f0817534e9f5809d318116" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 19:58:43 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:43:55 2026 +0200" }, "message": "lsusb: fix out-of-bounds read in video HEADER descriptor parsing\n\nIn dump_videocontrol_interface() case 0x01 (HEADER), buf[11] is accessed\nto read bInCollection before verifying that the descriptor is at least\n12 bytes long. A malicious USB device providing a descriptor shorter than\n12 bytes causes an out-of-bounds read.\n\nAdd an early bounds check for the minimum HEADER descriptor size (12\nbytes) and break out before accessing buf[7..11] if too short.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b5442f6976e135b0b0f0817534e9f5809d318116", "tree": "4cf3c2eda7892702bfcc24a6d47313c362d63220", "parents": [ "49856e80b4d827591276b647dc352c424a406931" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 19:58:21 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:43:55 2026 +0200" }, "message": "lsusb: fix unaligned memory access in dump_printer_device()\n\nCasting `\u0026buf[n+2]` to `uint16_t*` and dereferencing it is undefined\nbehavior when the address is not 2-byte aligned. On architectures with\nstrict alignment requirements (ARM, SPARC), this causes a bus error.\n\nReplace the unaligned cast with byte-wise access (buf[n+2] | buf[n+3]\u003c\u003c8)\nwhich is safe on all architectures and consistent with how other 16-bit\nvalues are read throughout the file.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "49856e80b4d827591276b647dc352c424a406931", "tree": "7125171492fa9095168db4263413aaeee6a4911c", "parents": [ "c800e6047907e2f23771b6a1e57fcece1d3316b8" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 19:57:42 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:38:57 2026 +0200" }, "message": "lsusb: fix out-of-bounds reads in video EXTENSION_UNIT descriptor parsing\n\nIn dump_videocontrol_interface() case 0x06 (EXTENSION_UNIT), the code\nreads buf[21] to get p, then buf[22+p] to get n, then buf[23+p+n] -\nall before checking whether the descriptor is long enough. A malicious\nUSB device providing a short descriptor can trigger out-of-bounds reads.\n\nMove the bounds checks before each dependent buffer access, and break\nout early if the descriptor is too short rather than continuing to\naccess invalid memory.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c800e6047907e2f23771b6a1e57fcece1d3316b8", "tree": "09bcf4db86e8620025fb921a5fd8659694814d76", "parents": [ "bbfa7f351d3a9043c1a3b43325b6726b9ff4e605" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 19:57:22 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:38:44 2026 +0200" }, "message": "lsusb: fix out-of-bounds array access in dump_encryption_type()\n\nThe bitmask `buf[2] \u0026 0x4` is incorrect for indexing the encryption_type\narray. The `\u0026 0x4` mask only produces values 0 or 4, making it impossible\nto select encryption types 1 (WIRED), 2 (CCM_1), or 3 (RSA_1). The\nbEncryptionType field from the USB descriptor is a full byte value, not\na bitfield.\n\nMore critically, if the mask were widened without bounds checking, values\nabove 4 would cause an out-of-bounds read on the 5-element array.\n\nFix by using the raw byte value with a proper bounds check against the\narray size, falling back to \"RESERVED\" for unknown types.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bbfa7f351d3a9043c1a3b43325b6726b9ff4e605", "tree": "750548ff32ec4624db7bca387a1115f430e859e7", "parents": [ "a1483b90795257be6450710e5aceee4f4f17624b" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 18:38:44 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:36:46 2026 +0200" }, "message": "sysfs: check initial snprintf() return value in get_sysfs_name()\n\nThe first snprintf() call for the bus number prefix was not checked for\ntruncation or error. If \u0027size\u0027 is very small and truncation occurs, \u0027len\u0027\nwould be set to a value \u003e\u003d size, causing \u0027size - len\u0027 to underflow as a\nsize_t in the subsequent loop, potentially passing a huge value to\nsnprintf().\n\nCheck the return value and return -1 on failure, consistent with the\nerror return used for LIBUSB_ERROR_OVERFLOW.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a1483b90795257be6450710e5aceee4f4f17624b", "tree": "c3e7c82ce1d6b7d3d808d3c5159333a0397ea2d7", "parents": [ "1aa1212eb38d83188f3e5c9da7fa001ef730dfdf" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 18:38:32 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:36:46 2026 +0200" }, "message": "sysfs: fix buffer handling in read_sysfs_prop()\n\nread_sysfs_prop() had two issues:\n\n1. It read up to \u0027size\u0027 bytes but then unconditionally overwrote\n buf[n-1] with a null terminator, destroying the last byte of data\n even when it was not a newline character.\n\n2. When read() filled the entire buffer (n \u003d\u003d size), there was no room\n for null termination, potentially leaving the buffer unterminated.\n\nFix by reading at most size-1 bytes to always leave room for null\ntermination, then only strip the trailing newline if it is actually\npresent.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1aa1212eb38d83188f3e5c9da7fa001ef730dfdf", "tree": "5f8a3aa472d7d663ab87e1a8245f7747246051fa", "parents": [ "fca91dc31f1b7ed452168a77b29158c22d7144ed" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 18:38:22 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:36:46 2026 +0200" }, "message": "names: fix missing null termination in get_vendor_product_with_fallback()\n\nstrncpy() does not null-terminate the destination buffer when the source\nstring length equals or exceeds the specified size. If vendor_len or\nproduct_len is less than 10 (strlen(\"[unknown]\") + 1), the resulting\nstrings would not be null-terminated, leading to potential buffer\nover-reads by callers.\n\nReplace strncpy() with snprintf() which always null-terminates.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "fca91dc31f1b7ed452168a77b29158c22d7144ed", "tree": "e67ede906676b01ccf386b1cad36ee1b4fdcd3a7", "parents": [ "a6c0b57adf63adc5f4665bafe98c7abee656933a" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 18:38:14 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:33:05 2026 +0200" }, "message": "desc-dump: fix integer underflow in get_array_entry_count()\n\nWhen computing inferred array length from malformed USB descriptors, the\naccumulated field sizes can exceed buf_len. Since \u0027size\u0027 is unsigned, the\nsubtraction wraps around to a very large value, causing an enormous entry\ncount that leads to out-of-bounds buffer reads.\n\nAdd a bounds check before each subtraction to return 0 entries when the\ndescriptor data is too short. Also guard against division by zero when\ncomputing the final entry count.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a6c0b57adf63adc5f4665bafe98c7abee656933a", "tree": "b1ae204e034701e5bfe696bde5cc716a01e12c8e", "parents": [ "ae7ea48797e910b7262602c423023b711fcf9c6b" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 18:37:58 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 27 16:33:05 2026 +0200" }, "message": "desc-dump: fix NULL pointer dereference for unknown audio terminal types\n\nnames_audioterminal() returns NULL when the terminal type is not found\nin the lookup table. Passing NULL directly to printf(\"%s\", ...) is\nundefined behavior and can crash on some platforms.\n\nAdd a NULL check and use \"(unknown)\" as a fallback string.\n\nAssisted-by: gkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" } ], "next": "ae7ea48797e910b7262602c423023b711fcf9c6b" }