--- /dev/null
+From 48c9d92fd4ee3a8f5d2cb46c802a0eff8e67c79c Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 22 May 2026 10:40:54 -0700
+Subject: Input: ims-pcu - add response length checks
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 48c9d92fd4ee3a8f5d2cb46c802a0eff8e67c79c upstream.
+
+The driver processes response data from device buffers without verifying
+that the device actually sent enough data. This can lead to
+out-of-bounds reads or processing stale data.
+
+Add checks for the expected response length before accessing the
+buffers.
+
+Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko bot <sashiko-bot@kernel.org>
+Assisted-by: Gemini:gemini-3.1-pro
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/ims-pcu.c | 87 ++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 81 insertions(+), 6 deletions(-)
+
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -407,7 +407,16 @@ static void ims_pcu_destroy_gamepad(stru
+
+ static void ims_pcu_report_events(struct ims_pcu *pcu)
+ {
+- u32 data = get_unaligned_be32(&pcu->read_buf[3]);
++ u32 data;
++
++ /* 6-axis setting (1 byte) + button data + checksum */
++ if (pcu->read_pos < IMS_PCU_DATA_OFFSET + 1 + sizeof(data) + 1) {
++ dev_warn(pcu->dev, "Short buttons report: %d bytes\n",
++ pcu->read_pos);
++ return;
++ }
++
++ data = get_unaligned_be32(&pcu->read_buf[IMS_PCU_DATA_OFFSET + 1]);
+
+ ims_pcu_buttons_report(pcu, data & ~IMS_PCU_GAMEPAD_MASK);
+ if (pcu->gamepad)
+@@ -667,11 +676,19 @@ static int __ims_pcu_execute_bl_command(
+ return error;
+ }
+
+- if (expected_response && pcu->cmd_buf[2] != expected_response) {
+- dev_err(pcu->dev,
+- "Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n",
+- pcu->cmd_buf[2], expected_response);
+- return -EINVAL;
++ if (expected_response) {
++ if (pcu->cmd_buf_len < 3) {
++ dev_err(pcu->dev, "Short response from bootloader: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
++ if (pcu->cmd_buf[2] != expected_response) {
++ dev_err(pcu->dev,
++ "Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n",
++ pcu->cmd_buf[2], expected_response);
++ return -EINVAL;
++ }
+ }
+
+ return 0;
+@@ -699,6 +716,12 @@ static int ims_pcu_get_info(struct ims_p
+ return error;
+ }
+
++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + IMS_PCU_SET_INFO_SIZE + 1) {
++ dev_err(pcu->dev, "Short GET_INFO response: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
+ memcpy(pcu->part_number,
+ &pcu->cmd_buf[IMS_PCU_INFO_PART_OFFSET],
+ sizeof(pcu->part_number));
+@@ -796,6 +819,12 @@ static int ims_pcu_verify_block(struct i
+ return error;
+ }
+
++ if (pcu->cmd_buf_len < IMS_PCU_BL_DATA_OFFSET + sizeof(*fragment) + len + 1) {
++ dev_err(pcu->dev, "Short READ_APP response: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
+ fragment = (void *)&pcu->cmd_buf[IMS_PCU_BL_DATA_OFFSET];
+ if (get_unaligned_le32(&fragment->addr) != addr ||
+ fragment->len != len) {
+@@ -993,6 +1022,10 @@ ims_pcu_backlight_get_brightness(struct
+ error);
+ /* Assume the LED is OFF */
+ brightness = LED_OFF;
++ } else if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 2 + 1) {
++ dev_err(pcu->dev, "Short GET_BRIGHTNESS response: %d bytes\n",
++ pcu->cmd_buf_len);
++ brightness = LED_OFF;
+ } else {
+ brightness =
+ get_unaligned_le16(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
+@@ -1272,6 +1305,12 @@ static int ims_pcu_read_ofn_config(struc
+ if (error)
+ return error;
+
++ if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) {
++ dev_err(pcu->dev, "Short OFN_GET_CONFIG response: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
+ result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET);
+ if (result < 0)
+ return -EIO;
+@@ -1292,6 +1331,12 @@ static int ims_pcu_write_ofn_config(stru
+ if (error)
+ return error;
+
++ if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) {
++ dev_err(pcu->dev, "Short OFN_SET_CONFIG response: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
+ result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET);
+ if (result < 0)
+ return -EIO;
+@@ -1811,6 +1856,12 @@ static int ims_pcu_get_device_info(struc
+ return error;
+ }
+
++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) {
++ dev_err(pcu->dev, "Short GET_FW_VERSION response: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
+ snprintf(pcu->fw_version, sizeof(pcu->fw_version),
+ "%02d%02d%02d%02d.%c%c",
+ pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
+@@ -1823,6 +1874,12 @@ static int ims_pcu_get_device_info(struc
+ return error;
+ }
+
++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) {
++ dev_err(pcu->dev, "Short GET_BL_VERSION response: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
+ snprintf(pcu->bl_version, sizeof(pcu->bl_version),
+ "%02d%02d%02d%02d.%c%c",
+ pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
+@@ -1835,6 +1892,12 @@ static int ims_pcu_get_device_info(struc
+ return error;
+ }
+
++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) {
++ dev_err(pcu->dev, "Short RESET_REASON response: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
+ snprintf(pcu->reset_reason, sizeof(pcu->reset_reason),
+ "%02x", pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
+
+@@ -1861,6 +1924,12 @@ static int ims_pcu_identify_type(struct
+ return error;
+ }
+
++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) {
++ dev_err(pcu->dev, "Short GET_DEVICE_ID response: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
+ *device_id = pcu->cmd_buf[IMS_PCU_DATA_OFFSET];
+ dev_dbg(pcu->dev, "Detected device ID: %d\n", *device_id);
+
+@@ -1966,6 +2035,12 @@ static int ims_pcu_init_bootloader_mode(
+ return error;
+ }
+
++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 15 + 4 + 1) {
++ dev_err(pcu->dev, "Short QUERY_DEVICE response: %d bytes\n",
++ pcu->cmd_buf_len);
++ return -EIO;
++ }
++
+ pcu->fw_start_addr =
+ get_unaligned_le32(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET + 11]);
+ pcu->fw_end_addr =
--- /dev/null
+From 8adf4289d945e8990e4336436a97da71d21d2cae Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 22 May 2026 10:30:44 -0700
+Subject: Input: ims-pcu - fix DMA mapping violation in line setup
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 8adf4289d945e8990e4336436a97da71d21d2cae upstream.
+
+In ims_pcu_line_setup(), the driver uses pcu->cmd_buf as a transfer
+buffer for usb_control_msg(). However, pcu->cmd_buf is embedded in the
+struct ims_pcu allocation, which violates DMA mapping rules regarding
+cacheline alignment.
+
+Use a heap-allocated buffer for the line coding data instead.
+
+Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko bot <sashiko-bot@kernel.org>
+Assisted-by: Gemini:gemini-3.1-pro
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/ims-pcu.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -1808,11 +1808,16 @@ static void ims_pcu_stop_io(struct ims_p
+ static int ims_pcu_line_setup(struct ims_pcu *pcu)
+ {
+ struct usb_host_interface *interface = pcu->ctrl_intf->cur_altsetting;
+- struct usb_cdc_line_coding *line = (void *)pcu->cmd_buf;
++ struct usb_cdc_line_coding *line __free(kfree) =
++ kmalloc(sizeof(*line), GFP_KERNEL);
+ int error;
+
+- memset(line, 0, sizeof(*line));
++ if (!line)
++ return -ENOMEM;
++
+ line->dwDTERate = cpu_to_le32(57600);
++ line->bCharFormat = USB_CDC_1_STOP_BITS;
++ line->bParityType = USB_CDC_NO_PARITY;
+ line->bDataBits = 8;
+
+ error = usb_control_msg(pcu->udev, usb_sndctrlpipe(pcu->udev, 0),
--- /dev/null
+From 403b0a6970b1084bb27907c0f8225801fdd0fe1d Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 22 May 2026 10:30:21 -0700
+Subject: Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 403b0a6970b1084bb27907c0f8225801fdd0fe1d upstream.
+
+The debug logging in ims_pcu_irq() unconditionally prints data from
+pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the
+actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the
+control URB exceeds pcu->max_in_size, this leads to an out-of-bounds
+read.
+
+Fix this by printing from the correct buffer associated with the URB.
+
+Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko bot <sashiko-bot@kernel.org>
+Assisted-by: Gemini:gemini-3.1-pro
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/ims-pcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -1547,7 +1547,7 @@ static void ims_pcu_irq(struct urb *urb)
+ }
+
+ dev_dbg(pcu->dev, "%s: received %d: %*ph\n", __func__,
+- urb->actual_length, urb->actual_length, pcu->urb_in_buf);
++ urb->actual_length, urb->actual_length, urb->transfer_buffer);
+
+ if (urb == pcu->urb_in)
+ ims_pcu_process_data(pcu, urb);
--- /dev/null
+From d4579af29e67ca8722db0a1194227f8015c8981d Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 22 May 2026 21:42:39 -0700
+Subject: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit d4579af29e67ca8722db0a1194227f8015c8981d upstream.
+
+The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc()
+by iterating through the extra descriptor data. However, it does not
+verify that the bLength of each descriptor is at least 2. A malicious
+device could provide a descriptor with bLength = 0, leading to an
+infinite loop in the driver.
+
+Add a check to ensure bLength is at least 2 before proceeding with
+parsing.
+
+Fixes: 628329d52474 (Input: add IMS Passenger Control Unit driver)
+Cc: stable@vger.kernel.org
+Assisted-by: Gemini:gemini-3.1-pro
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/ims-pcu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -1675,8 +1675,9 @@ ims_pcu_get_cdc_union_desc(struct usb_in
+ while (buflen >= sizeof(*union_desc)) {
+ union_desc = (struct usb_cdc_union_desc *)buf;
+
+- if (union_desc->bLength > buflen) {
+- dev_err(&intf->dev, "Too large descriptor\n");
++ if (union_desc->bLength < 2 || union_desc->bLength > buflen) {
++ dev_err(&intf->dev, "Invalid descriptor length: %d\n",
++ union_desc->bLength);
+ return NULL;
+ }
+
--- /dev/null
+From ca459e237bc49567649c56bc72e4c602fb92fd67 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 22 May 2026 10:25:11 -0700
+Subject: Input: ims-pcu - fix type confusion in CDC union descriptor parsing
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit ca459e237bc49567649c56bc72e4c602fb92fd67 upstream.
+
+The driver currently trusts the bMasterInterface0 from the CDC union
+descriptor without verifying that it matches the interface being
+probed. This could lead to the driver overwriting the private data of
+another interface.
+
+Validate that the control interface found in the descriptor is indeed
+the one we are probing.
+
+Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko bot <sashiko-bot@kernel.org>
+Assisted-by: Gemini:gemini-3.1-pro
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/ims-pcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -1713,7 +1713,7 @@ static int ims_pcu_parse_cdc_data(struct
+
+ pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
+ union_desc->bMasterInterface0);
+- if (!pcu->ctrl_intf)
++ if (pcu->ctrl_intf != intf)
+ return -EINVAL;
+
+ alt = pcu->ctrl_intf->cur_altsetting;
--- /dev/null
+From 462a999917755a3bf77448dfd64307963cf0a9f0 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 22 May 2026 10:24:47 -0700
+Subject: Input: ims-pcu - fix use-after-free and double-free in disconnect
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 462a999917755a3bf77448dfd64307963cf0a9f0 upstream.
+
+ims_pcu_disconnect() only intended to perform cleanup when the primary
+(control) interface is unbound. However, it currently relies on the
+interface class to distinguish between control and data interfaces.
+A malicious device could present a data interface with the same class
+as the control interface, leading to premature cleanup and potential
+use-after-free or double-free.
+
+Switch to verifying that the interface being disconnected is indeed
+the control interface.
+
+Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko bot <sashiko-bot@kernel.org>
+Assisted-by: Gemini:gemini-3.1-pro
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/ims-pcu.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -2066,7 +2066,6 @@ err_free_mem:
+ static void ims_pcu_disconnect(struct usb_interface *intf)
+ {
+ struct ims_pcu *pcu = usb_get_intfdata(intf);
+- struct usb_host_interface *alt = intf->cur_altsetting;
+
+ usb_set_intfdata(intf, NULL);
+
+@@ -2074,7 +2073,7 @@ static void ims_pcu_disconnect(struct us
+ * See if we are dealing with control or data interface. The cleanup
+ * happens when we unbind primary (control) interface.
+ */
+- if (alt->desc.bInterfaceClass != USB_CLASS_COMM)
++ if (intf != pcu->ctrl_intf)
+ return;
+
+ sysfs_remove_group(&intf->dev.kobj, &ims_pcu_attr_group);
--- /dev/null
+From 441c510a649c8ddce38aa0311334ed8bb546b36c Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 22 May 2026 10:22:55 -0700
+Subject: Input: ims-pcu - release data interface on disconnect
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 441c510a649c8ddce38aa0311334ed8bb546b36c upstream.
+
+During probe the driver claims the data interface, but it never releases
+it. Release it in disconnect to avoid leaving it permanently claimed.
+
+Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko bot <sashiko-bot@kernel.org>
+Assisted-by: Gemini:gemini-3.1-pro
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/ims-pcu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -2086,6 +2086,7 @@ static void ims_pcu_disconnect(struct us
+ ims_pcu_destroy_application_mode(pcu);
+
+ ims_pcu_buffers_free(pcu);
++ usb_driver_release_interface(&ims_pcu_driver, pcu->data_intf);
+ kfree(pcu);
+ }
+
--- /dev/null
+From baf56975806534268e24acf9a8abb1c447ce11e9 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 22 May 2026 10:29:26 -0700
+Subject: Input: ims-pcu - validate control endpoint type
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit baf56975806534268e24acf9a8abb1c447ce11e9 upstream.
+
+The driver currently assumes that the first endpoint of the control
+interface is an interrupt IN endpoint without verifying it. A malicious
+device could provide a different endpoint type, which would then be
+passed to usb_fill_int_urb(), potentially leading to kernel warnings
+or undefined behavior.
+
+Verify that the control endpoint is an interrupt IN endpoint.
+
+Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko bot <sashiko-bot@kernel.org>
+Assisted-by: Gemini:gemini-3.1-pro
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/ims-pcu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -1676,6 +1676,12 @@ static int ims_pcu_parse_cdc_data(struct
+ return -ENODEV;
+
+ pcu->ep_ctrl = &alt->endpoint[0].desc;
++ if (!usb_endpoint_is_int_in(pcu->ep_ctrl)) {
++ dev_err(pcu->dev,
++ "Control endpoint is not INTERRUPT IN\n");
++ return -EINVAL;
++ }
++
+ pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl);
+
+ pcu->data_intf = usb_ifnum_to_if(pcu->udev,
scsi-hpsa-fix-dma-mapping-leak-on-ioaccel2-reset-path.patch
scsi-sg-report-request-table-problems-when-any-status-is-set.patch
scsi-target-core-fix-iscsi-isid-use-after-free-in-register-and-move.patch
+input-ims-pcu-fix-use-after-free-and-double-free-in-disconnect.patch
+input-ims-pcu-release-data-interface-on-disconnect.patch
+input-ims-pcu-validate-control-endpoint-type.patch
+input-ims-pcu-add-response-length-checks.patch
+input-ims-pcu-fix-dma-mapping-violation-in-line-setup.patch
+input-ims-pcu-fix-out-of-bounds-read-in-ims_pcu_irq-debug-logging.patch
+input-ims-pcu-fix-potential-infinite-loop-in-cdc-union-descriptor-parsing.patch
+input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
