--- /dev/null
+From 3111491fca4f01764e0c158c5e0f7ced808eef51 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Jan 2020 11:59:32 -0800
+Subject: Input: aiptek - fix endpoint sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 3111491fca4f01764e0c158c5e0f7ced808eef51 upstream.
+
+The driver was checking the number of endpoints of the first alternate
+setting instead of the current one, something which could lead to the
+driver binding to an invalid interface.
+
+This in turn could cause the driver to misbehave or trigger a WARN() in
+usb_submit_urb() that kernels with panic_on_warn set would choke on.
+
+Fixes: 8e20cf2bce12 ("Input: aiptek - fix crash on detecting device without endpoints")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Vladis Dronov <vdronov@redhat.com>
+Link: https://lore.kernel.org/r/20191210113737.4016-3-johan@kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/tablet/aiptek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/input/tablet/aiptek.c
++++ b/drivers/input/tablet/aiptek.c
+@@ -1820,14 +1820,14 @@ aiptek_probe(struct usb_interface *intf,
+ input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
+
+ /* Verify that a device really has an endpoint */
+- if (intf->altsetting[0].desc.bNumEndpoints < 1) {
++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
+ dev_err(&intf->dev,
+ "interface has %d endpoints, but must have minimum 1\n",
+- intf->altsetting[0].desc.bNumEndpoints);
++ intf->cur_altsetting->desc.bNumEndpoints);
+ err = -EINVAL;
+ goto fail3;
+ }
+- endpoint = &intf->altsetting[0].endpoint[0].desc;
++ endpoint = &intf->cur_altsetting->endpoint[0].desc;
+
+ /* Go set up our URB, which is called when the tablet receives
+ * input.
--- /dev/null
+From a8eeb74df5a6bdb214b2b581b14782c5f5a0cf83 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Jan 2020 12:00:18 -0800
+Subject: Input: gtco - fix endpoint sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit a8eeb74df5a6bdb214b2b581b14782c5f5a0cf83 upstream.
+
+The driver was checking the number of endpoints of the first alternate
+setting instead of the current one, something which could lead to the
+driver binding to an invalid interface.
+
+This in turn could cause the driver to misbehave or trigger a WARN() in
+usb_submit_urb() that kernels with panic_on_warn set would choke on.
+
+Fixes: 162f98dea487 ("Input: gtco - fix crash on detecting device without endpoints")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Vladis Dronov <vdronov@redhat.com>
+Link: https://lore.kernel.org/r/20191210113737.4016-5-johan@kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/tablet/gtco.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/drivers/input/tablet/gtco.c
++++ b/drivers/input/tablet/gtco.c
+@@ -876,18 +876,14 @@ static int gtco_probe(struct usb_interfa
+ }
+
+ /* Sanity check that a device has an endpoint */
+- if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
++ if (usbinterface->cur_altsetting->desc.bNumEndpoints < 1) {
+ dev_err(&usbinterface->dev,
+ "Invalid number of endpoints\n");
+ error = -EINVAL;
+ goto err_free_urb;
+ }
+
+- /*
+- * The endpoint is always altsetting 0, we know this since we know
+- * this device only has one interrupt endpoint
+- */
+- endpoint = &usbinterface->altsetting[0].endpoint[0].desc;
++ endpoint = &usbinterface->cur_altsetting->endpoint[0].desc;
+
+ /* Some debug */
+ dev_dbg(&usbinterface->dev, "gtco # interfaces: %d\n", usbinterface->num_altsetting);
+@@ -974,7 +970,7 @@ static int gtco_probe(struct usb_interfa
+ input_dev->dev.parent = &usbinterface->dev;
+
+ /* Setup the URB, it will be posted later on open of input device */
+- endpoint = &usbinterface->altsetting[0].endpoint[0].desc;
++ endpoint = &usbinterface->cur_altsetting->endpoint[0].desc;
+
+ usb_fill_int_urb(gtco->urbinfo,
+ gtco->usbdev,
--- /dev/null
+From 6b32391ed675827f8425a414abbc6fbd54ea54fe Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Jan 2020 12:01:27 -0800
+Subject: Input: sur40 - fix interface sanity checks
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 6b32391ed675827f8425a414abbc6fbd54ea54fe upstream.
+
+Make sure to use the current alternate setting when verifying the
+interface descriptors to avoid binding to an invalid interface.
+
+This in turn could cause the driver to misbehave or trigger a WARN() in
+usb_submit_urb() that kernels with panic_on_warn set would choke on.
+
+Fixes: bdb5c57f209c ("Input: add sur40 driver for Samsung SUR40 (aka MS Surface 2.0/Pixelsense)")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Vladis Dronov <vdronov@redhat.com>
+Link: https://lore.kernel.org/r/20191210113737.4016-8-johan@kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/touchscreen/sur40.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/sur40.c
++++ b/drivers/input/touchscreen/sur40.c
+@@ -496,7 +496,7 @@ static int sur40_probe(struct usb_interf
+ int error;
+
+ /* Check if we really have the right interface. */
+- iface_desc = &interface->altsetting[0];
++ iface_desc = interface->cur_altsetting;
+ if (iface_desc->desc.bInterfaceClass != 0xFF)
+ return -ENODEV;
+
input-keyspan-remote-fix-control-message-timeouts.patch
arm-8950-1-ftrace-recordmcount-filter-relocation-types.patch
mmc-sdhci-fix-minimum-clock-rate-for-v3-controller.patch
+input-sur40-fix-interface-sanity-checks.patch
+input-gtco-fix-endpoint-sanity-check.patch
+input-aiptek-fix-endpoint-sanity-check.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
