Input: keyspan-remote - fix control-message timeouts

BugLink: https://bugs.launchpad.net/bugs/1864261
commit ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 upstream.

The driver was issuing synchronous uninterruptible control requests
without using a timeout. This could lead to the driver hanging on probe
due to a malfunctioning (or malicious) device until the device is
physically disconnected. While sleeping in probe the driver prevents
other devices connected to the same hub from being added to (or removed
from) the bus.

The USB upper limit of five seconds per request should be more than
enough.

Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote")
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable <stable@vger.kernel.org>     # 2.6.13
Link: https://lore.kernel.org/r/20200113171715.30621-1-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/drivers/input/misc/keyspan_remote.c b/drivers/input/misc/keyspan_remote.c
index 77c47d6325fe91dca54f5b18d6c2a43c561b7f4c..a9ee813eef10f83e7f4de3c46bcfbc24ef8817c5 100644 (file)
--- a/drivers/input/misc/keyspan_remote.c
+++ b/drivers/input/misc/keyspan_remote.c
@@ -344,7 +344,8 @@ static int keyspan_setup(struct usb_device* dev)
        int retval = 0;
 
        retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-                                0x11, 0x40, 0x5601, 0x0, NULL, 0, 0);
+                                0x11, 0x40, 0x5601, 0x0, NULL, 0,
+                                USB_CTRL_SET_TIMEOUT);
        if (retval) {
                dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n",
                        __func__, retval);
@@ -352,7 +353,8 @@ static int keyspan_setup(struct usb_device* dev)
        }
 
        retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-                                0x44, 0x40, 0x0, 0x0, NULL, 0, 0);
+                                0x44, 0x40, 0x0, 0x0, NULL, 0,
+                                USB_CTRL_SET_TIMEOUT);
        if (retval) {
                dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n",
                        __func__, retval);
@@ -360,7 +362,8 @@ static int keyspan_setup(struct usb_device* dev)
        }
 
        retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-                                0x22, 0x40, 0x0, 0x0, NULL, 0, 0);
+                                0x22, 0x40, 0x0, 0x0, NULL, 0,
+                                USB_CTRL_SET_TIMEOUT);
        if (retval) {
                dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n",
                        __func__, retval);