Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Input: keyspan-remote - fix control-message timeouts

The driver was issuing synchronous uninterruptible control requests
without using a timeout. This could lead to the driver hanging on probe
due to a malfunctioning (or malicious) device until the device is
physically disconnected. While sleeping in probe the driver prevents
other devices connected to the same hub from being added to (or removed
from) the bus.

The USB upper limit of five seconds per request should be more than
enough.

Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote")
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable <stable@vger.kernel.org> # 2.6.13
Link: https://lore.kernel.org/r/20200113171715.30621-1-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

authored by

Johan Hovold and committed by
Dmitry Torokhov
ba9a103f ce535a2e

+6 -3
+6 -3
drivers/input/misc/keyspan_remote.c
··· 336 336 int retval = 0; 337 337 338 338 retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 339 - 0x11, 0x40, 0x5601, 0x0, NULL, 0, 0); 339 + 0x11, 0x40, 0x5601, 0x0, NULL, 0, 340 + USB_CTRL_SET_TIMEOUT); 340 341 if (retval) { 341 342 dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n", 342 343 __func__, retval); ··· 345 344 } 346 345 347 346 retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 348 - 0x44, 0x40, 0x0, 0x0, NULL, 0, 0); 347 + 0x44, 0x40, 0x0, 0x0, NULL, 0, 348 + USB_CTRL_SET_TIMEOUT); 349 349 if (retval) { 350 350 dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n", 351 351 __func__, retval); ··· 354 352 } 355 353 356 354 retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 357 - 0x22, 0x40, 0x0, 0x0, NULL, 0, 0); 355 + 0x22, 0x40, 0x0, 0x0, NULL, 0, 356 + USB_CTRL_SET_TIMEOUT); 358 357 if (retval) { 359 358 dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n", 360 359 __func__, retval);