Merge tag 'usb-4.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are a number of small USB fixes for 4.18-rc5.

  Nothing major here, just the normal set of new device ids, xhci fixes,
  and some typec fixes. The typec fix required some tiny changes in an
  i2c driver, which that maintainer acked to come through my tree.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-4.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: yurex: fix out-of-bounds uaccess in read handler
  usb: quirks: add delay quirks for Corsair Strafe
  xhci: xhci-mem: off by one in xhci_stream_id_to_ring()
  usb/gadget: aspeed-vhub: add USB_LIBCOMPOSITE dependency
  docs: kernel-parameters.txt: document xhci-hcd.quirks parameter
  USB: serial: mos7840: fix status-register error handling
  USB: serial: keyspan_pda: fix modem-status error handling
  USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick
  USB: serial: ch341: fix type promotion bug in ch341_control_in()
  i2c-cht-wc: Fix bq24190 supplier
  typec: tcpm: Correctly report power_supply current and voltage for non pd supply
  usb: xhci: dbc: Don't decrement runtime PM counter if DBC is not started

1 files changed, 6 insertions, 17 deletions

diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 8abb6cbbd98a..3be40eaa1ac9 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -396,8 +396,7 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
 			  loff_t *ppos)
 {
 	struct usb_yurex *dev;
-	int retval = 0;
-	int bytes_read = 0;
+	int len = 0;
 	char in_buffer[20];
 	unsigned long flags;
 
@@ -405,26 +404,16 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
 
 	mutex_lock(&dev->io_mutex);
 	if (!dev->interface) {		/* already disconnected */
-		retval = -ENODEV;
-		goto exit;
+		mutex_unlock(&dev->io_mutex);
+		return -ENODEV;
 	}
 
 	spin_lock_irqsave(&dev->lock, flags);
-	bytes_read = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
+	len = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
 	spin_unlock_irqrestore(&dev->lock, flags);
-
-	if (*ppos < bytes_read) {
-		if (copy_to_user(buffer, in_buffer + *ppos, bytes_read - *ppos))
-			retval = -EFAULT;
-		else {
-			retval = bytes_read - *ppos;
-			*ppos += bytes_read;
-		}
-	}
-
-exit:
 	mutex_unlock(&dev->io_mutex);
-	return retval;
+
+	return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
 }
 
 static ssize_t yurex_write(struct file *file, const char __user *user_buffer,