From: Johan Hovold <johan@kernel.org>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [GIT PULL] USB serial fixes for 7.4-rc1
Date: Fri, 30 Oct 2026 18:26:41 +0100 [thread overview]
Message-ID: <auTTUf8alxj9ay6X@hovoldconsulting.com> (raw)
The following changes since commit c339f4010dea8b0d754f84ace70cd1b089878ef8:
Merge tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 (2026-10-28 07:36:32 -1000)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial.git tags/usb-serial-7.4-rc1-2
for you to fetch changes up to ab89a9dab02d9553eb0cc27fd3e4a4998acbc8e9:
USB: serial: garmin_gps: fix deadlock on reset request (2026-10-29 16:26:41 +0100)
----------------------------------------------------------------
USB serial fixes for 7.4-rc1
Here are a number of fixes for issues hit by syzbot, flagged by Sashiko
or LLM audits, or found through inspection:
- fix NULL-deref on upd78f0730 hangup (including disconnect)
- fix OOB read or NULL-deref in garmin_gps on crafted write()
- fix deadlock on garmin_gps write() reset request
- fix NULL-deref on early io_edgeport status
- fix UAF on io_edgeport close() race
- fix NULL-deref on io_edgeport open() race
- fix io_edgeport fifo corruption on stray open response
- fix UAF on io_edgeport disconnect
- fix missing io_edgeport MCR locking
- fix oti6858 teardown order to avoid open failure and disconnect UAF
- fix OOB read on short sierra interrupt message
Everything has been in linux-next over night and with no reported
issues.
----------------------------------------------------------------
Hui Peng (1):
USB: serial: garmin_gps: validate packet data length in nat_receive()
Johan Hovold (9):
USB: serial: upd78f0730: fix NULL-deref on hangup
USB: serial: io_edgeport: fix NULL-deref on early status
USB: serial: io_edgeport: fix potential close() use-after-free
USB: serial: io_edgeport: fix potential NULL-deref at open
USB: serial: io_edgeport: move initial termios update to open()
USB: serial: io_edgeport: fix potential fifo corruption
USB: serial: io_edgeport: fix potential use-after-free on disconnect
USB: serial: io_edgeport: serialise MCR accesses
USB: serial: garmin_gps: fix deadlock on reset request
Josef Bacik (1):
USB: serial: oti6858: fix the teardown order in close
Tristan Madani (1):
USB: serial: sierra: validate URB length in instat callback
drivers/usb/serial/garmin_gps.c | 31 +++++----
drivers/usb/serial/io_edgeport.c | 141 +++++++++++++++++----------------------
drivers/usb/serial/oti6858.c | 16 +++--
drivers/usb/serial/sierra.c | 18 ++++-
drivers/usb/serial/upd78f0730.c | 13 ++--
5 files changed, 114 insertions(+), 105 deletions(-)
next reply other threads:[~2026-10-30 17:26 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-30 17:26 Johan Hovold [this message]
2026-10-30 22:30 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=auTTUf8alxj9ay6X@hovoldconsulting.com \
--to=johan@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®