From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 15:46:57 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=345f29716a02f960797ff6bc34e7e07650312084;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: input-ims-pcu-add-response-length-checks.patch input-ims-pcu-fix-dma-mapping-violation-in-line-setup.patch input-ims-pcu-fix-out-of-bounds-read-in-ims_pcu_irq-debug-logging.patch input-ims-pcu-fix-potential-infinite-loop-in-cdc-union-descriptor-parsing.patch input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch input-ims-pcu-fix-use-after-free-and-double-free-in-disconnect.patch input-ims-pcu-release-data-interface-on-disconnect.patch input-ims-pcu-validate-control-endpoint-type.patch --- diff --git a/queue-5.10/input-ims-pcu-add-response-length-checks.patch b/queue-5.10/input-ims-pcu-add-response-length-checks.patch new file mode 100644 index 0000000000..a05248e6e0 --- /dev/null +++ b/queue-5.10/input-ims-pcu-add-response-length-checks.patch @@ -0,0 +1,199 @@ +From 48c9d92fd4ee3a8f5d2cb46c802a0eff8e67c79c Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 22 May 2026 10:40:54 -0700 +Subject: Input: ims-pcu - add response length checks + +From: Dmitry Torokhov + +commit 48c9d92fd4ee3a8f5d2cb46c802a0eff8e67c79c upstream. + +The driver processes response data from device buffers without verifying +that the device actually sent enough data. This can lead to +out-of-bounds reads or processing stale data. + +Add checks for the expected response length before accessing the +buffers. + +Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") +Cc: stable@vger.kernel.org +Reported-by: Sashiko bot +Assisted-by: Gemini:gemini-3.1-pro +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/ims-pcu.c | 87 ++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 81 insertions(+), 6 deletions(-) + +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -407,7 +407,16 @@ static void ims_pcu_destroy_gamepad(stru + + static void ims_pcu_report_events(struct ims_pcu *pcu) + { +- u32 data = get_unaligned_be32(&pcu->read_buf[3]); ++ u32 data; ++ ++ /* 6-axis setting (1 byte) + button data + checksum */ ++ if (pcu->read_pos < IMS_PCU_DATA_OFFSET + 1 + sizeof(data) + 1) { ++ dev_warn(pcu->dev, "Short buttons report: %d bytes\n", ++ pcu->read_pos); ++ return; ++ } ++ ++ data = get_unaligned_be32(&pcu->read_buf[IMS_PCU_DATA_OFFSET + 1]); + + ims_pcu_buttons_report(pcu, data & ~IMS_PCU_GAMEPAD_MASK); + if (pcu->gamepad) +@@ -667,11 +676,19 @@ static int __ims_pcu_execute_bl_command( + return error; + } + +- if (expected_response && pcu->cmd_buf[2] != expected_response) { +- dev_err(pcu->dev, +- "Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n", +- pcu->cmd_buf[2], expected_response); +- return -EINVAL; ++ if (expected_response) { ++ if (pcu->cmd_buf_len < 3) { ++ dev_err(pcu->dev, "Short response from bootloader: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ ++ if (pcu->cmd_buf[2] != expected_response) { ++ dev_err(pcu->dev, ++ "Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n", ++ pcu->cmd_buf[2], expected_response); ++ return -EINVAL; ++ } + } + + return 0; +@@ -699,6 +716,12 @@ static int ims_pcu_get_info(struct ims_p + return error; + } + ++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + IMS_PCU_SET_INFO_SIZE + 1) { ++ dev_err(pcu->dev, "Short GET_INFO response: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ + memcpy(pcu->part_number, + &pcu->cmd_buf[IMS_PCU_INFO_PART_OFFSET], + sizeof(pcu->part_number)); +@@ -796,6 +819,12 @@ static int ims_pcu_verify_block(struct i + return error; + } + ++ if (pcu->cmd_buf_len < IMS_PCU_BL_DATA_OFFSET + sizeof(*fragment) + len + 1) { ++ dev_err(pcu->dev, "Short READ_APP response: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ + fragment = (void *)&pcu->cmd_buf[IMS_PCU_BL_DATA_OFFSET]; + if (get_unaligned_le32(&fragment->addr) != addr || + fragment->len != len) { +@@ -993,6 +1022,10 @@ ims_pcu_backlight_get_brightness(struct + error); + /* Assume the LED is OFF */ + brightness = LED_OFF; ++ } else if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 2 + 1) { ++ dev_err(pcu->dev, "Short GET_BRIGHTNESS response: %d bytes\n", ++ pcu->cmd_buf_len); ++ brightness = LED_OFF; + } else { + brightness = + get_unaligned_le16(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET]); +@@ -1272,6 +1305,12 @@ static int ims_pcu_read_ofn_config(struc + if (error) + return error; + ++ if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) { ++ dev_err(pcu->dev, "Short OFN_GET_CONFIG response: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ + result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET); + if (result < 0) + return -EIO; +@@ -1292,6 +1331,12 @@ static int ims_pcu_write_ofn_config(stru + if (error) + return error; + ++ if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) { ++ dev_err(pcu->dev, "Short OFN_SET_CONFIG response: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ + result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET); + if (result < 0) + return -EIO; +@@ -1811,6 +1856,12 @@ static int ims_pcu_get_device_info(struc + return error; + } + ++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) { ++ dev_err(pcu->dev, "Short GET_FW_VERSION response: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ + snprintf(pcu->fw_version, sizeof(pcu->fw_version), + "%02d%02d%02d%02d.%c%c", + pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5], +@@ -1823,6 +1874,12 @@ static int ims_pcu_get_device_info(struc + return error; + } + ++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) { ++ dev_err(pcu->dev, "Short GET_BL_VERSION response: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ + snprintf(pcu->bl_version, sizeof(pcu->bl_version), + "%02d%02d%02d%02d.%c%c", + pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5], +@@ -1835,6 +1892,12 @@ static int ims_pcu_get_device_info(struc + return error; + } + ++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) { ++ dev_err(pcu->dev, "Short RESET_REASON response: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ + snprintf(pcu->reset_reason, sizeof(pcu->reset_reason), + "%02x", pcu->cmd_buf[IMS_PCU_DATA_OFFSET]); + +@@ -1861,6 +1924,12 @@ static int ims_pcu_identify_type(struct + return error; + } + ++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) { ++ dev_err(pcu->dev, "Short GET_DEVICE_ID response: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ + *device_id = pcu->cmd_buf[IMS_PCU_DATA_OFFSET]; + dev_dbg(pcu->dev, "Detected device ID: %d\n", *device_id); + +@@ -1966,6 +2035,12 @@ static int ims_pcu_init_bootloader_mode( + return error; + } + ++ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 15 + 4 + 1) { ++ dev_err(pcu->dev, "Short QUERY_DEVICE response: %d bytes\n", ++ pcu->cmd_buf_len); ++ return -EIO; ++ } ++ + pcu->fw_start_addr = + get_unaligned_le32(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET + 11]); + pcu->fw_end_addr = diff --git a/queue-5.10/input-ims-pcu-fix-dma-mapping-violation-in-line-setup.patch b/queue-5.10/input-ims-pcu-fix-dma-mapping-violation-in-line-setup.patch new file mode 100644 index 0000000000..3bc4b5df7d --- /dev/null +++ b/queue-5.10/input-ims-pcu-fix-dma-mapping-violation-in-line-setup.patch @@ -0,0 +1,47 @@ +From 8adf4289d945e8990e4336436a97da71d21d2cae Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 22 May 2026 10:30:44 -0700 +Subject: Input: ims-pcu - fix DMA mapping violation in line setup + +From: Dmitry Torokhov + +commit 8adf4289d945e8990e4336436a97da71d21d2cae upstream. + +In ims_pcu_line_setup(), the driver uses pcu->cmd_buf as a transfer +buffer for usb_control_msg(). However, pcu->cmd_buf is embedded in the +struct ims_pcu allocation, which violates DMA mapping rules regarding +cacheline alignment. + +Use a heap-allocated buffer for the line coding data instead. + +Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") +Cc: stable@vger.kernel.org +Reported-by: Sashiko bot +Assisted-by: Gemini:gemini-3.1-pro +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/ims-pcu.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -1808,11 +1808,16 @@ static void ims_pcu_stop_io(struct ims_p + static int ims_pcu_line_setup(struct ims_pcu *pcu) + { + struct usb_host_interface *interface = pcu->ctrl_intf->cur_altsetting; +- struct usb_cdc_line_coding *line = (void *)pcu->cmd_buf; ++ struct usb_cdc_line_coding *line __free(kfree) = ++ kmalloc(sizeof(*line), GFP_KERNEL); + int error; + +- memset(line, 0, sizeof(*line)); ++ if (!line) ++ return -ENOMEM; ++ + line->dwDTERate = cpu_to_le32(57600); ++ line->bCharFormat = USB_CDC_1_STOP_BITS; ++ line->bParityType = USB_CDC_NO_PARITY; + line->bDataBits = 8; + + error = usb_control_msg(pcu->udev, usb_sndctrlpipe(pcu->udev, 0), diff --git a/queue-5.10/input-ims-pcu-fix-out-of-bounds-read-in-ims_pcu_irq-debug-logging.patch b/queue-5.10/input-ims-pcu-fix-out-of-bounds-read-in-ims_pcu_irq-debug-logging.patch new file mode 100644 index 0000000000..bfcb407a7b --- /dev/null +++ b/queue-5.10/input-ims-pcu-fix-out-of-bounds-read-in-ims_pcu_irq-debug-logging.patch @@ -0,0 +1,38 @@ +From 403b0a6970b1084bb27907c0f8225801fdd0fe1d Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 22 May 2026 10:30:21 -0700 +Subject: Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging + +From: Dmitry Torokhov + +commit 403b0a6970b1084bb27907c0f8225801fdd0fe1d upstream. + +The debug logging in ims_pcu_irq() unconditionally prints data from +pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the +actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the +control URB exceeds pcu->max_in_size, this leads to an out-of-bounds +read. + +Fix this by printing from the correct buffer associated with the URB. + +Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") +Cc: stable@vger.kernel.org +Reported-by: Sashiko bot +Assisted-by: Gemini:gemini-3.1-pro +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/ims-pcu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -1547,7 +1547,7 @@ static void ims_pcu_irq(struct urb *urb) + } + + dev_dbg(pcu->dev, "%s: received %d: %*ph\n", __func__, +- urb->actual_length, urb->actual_length, pcu->urb_in_buf); ++ urb->actual_length, urb->actual_length, urb->transfer_buffer); + + if (urb == pcu->urb_in) + ims_pcu_process_data(pcu, urb); diff --git a/queue-5.10/input-ims-pcu-fix-potential-infinite-loop-in-cdc-union-descriptor-parsing.patch b/queue-5.10/input-ims-pcu-fix-potential-infinite-loop-in-cdc-union-descriptor-parsing.patch new file mode 100644 index 0000000000..5181170a9b --- /dev/null +++ b/queue-5.10/input-ims-pcu-fix-potential-infinite-loop-in-cdc-union-descriptor-parsing.patch @@ -0,0 +1,41 @@ +From d4579af29e67ca8722db0a1194227f8015c8981d Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 22 May 2026 21:42:39 -0700 +Subject: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing + +From: Dmitry Torokhov + +commit d4579af29e67ca8722db0a1194227f8015c8981d upstream. + +The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc() +by iterating through the extra descriptor data. However, it does not +verify that the bLength of each descriptor is at least 2. A malicious +device could provide a descriptor with bLength = 0, leading to an +infinite loop in the driver. + +Add a check to ensure bLength is at least 2 before proceeding with +parsing. + +Fixes: 628329d52474 (Input: add IMS Passenger Control Unit driver) +Cc: stable@vger.kernel.org +Assisted-by: Gemini:gemini-3.1-pro +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/ims-pcu.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -1675,8 +1675,9 @@ ims_pcu_get_cdc_union_desc(struct usb_in + while (buflen >= sizeof(*union_desc)) { + union_desc = (struct usb_cdc_union_desc *)buf; + +- if (union_desc->bLength > buflen) { +- dev_err(&intf->dev, "Too large descriptor\n"); ++ if (union_desc->bLength < 2 || union_desc->bLength > buflen) { ++ dev_err(&intf->dev, "Invalid descriptor length: %d\n", ++ union_desc->bLength); + return NULL; + } + diff --git a/queue-5.10/input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch b/queue-5.10/input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch new file mode 100644 index 0000000000..0f8b594651 --- /dev/null +++ b/queue-5.10/input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch @@ -0,0 +1,38 @@ +From ca459e237bc49567649c56bc72e4c602fb92fd67 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 22 May 2026 10:25:11 -0700 +Subject: Input: ims-pcu - fix type confusion in CDC union descriptor parsing + +From: Dmitry Torokhov + +commit ca459e237bc49567649c56bc72e4c602fb92fd67 upstream. + +The driver currently trusts the bMasterInterface0 from the CDC union +descriptor without verifying that it matches the interface being +probed. This could lead to the driver overwriting the private data of +another interface. + +Validate that the control interface found in the descriptor is indeed +the one we are probing. + +Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") +Cc: stable@vger.kernel.org +Reported-by: Sashiko bot +Assisted-by: Gemini:gemini-3.1-pro +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/ims-pcu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -1713,7 +1713,7 @@ static int ims_pcu_parse_cdc_data(struct + + pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev, + union_desc->bMasterInterface0); +- if (!pcu->ctrl_intf) ++ if (pcu->ctrl_intf != intf) + return -EINVAL; + + alt = pcu->ctrl_intf->cur_altsetting; diff --git a/queue-5.10/input-ims-pcu-fix-use-after-free-and-double-free-in-disconnect.patch b/queue-5.10/input-ims-pcu-fix-use-after-free-and-double-free-in-disconnect.patch new file mode 100644 index 0000000000..678c5270e3 --- /dev/null +++ b/queue-5.10/input-ims-pcu-fix-use-after-free-and-double-free-in-disconnect.patch @@ -0,0 +1,48 @@ +From 462a999917755a3bf77448dfd64307963cf0a9f0 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 22 May 2026 10:24:47 -0700 +Subject: Input: ims-pcu - fix use-after-free and double-free in disconnect + +From: Dmitry Torokhov + +commit 462a999917755a3bf77448dfd64307963cf0a9f0 upstream. + +ims_pcu_disconnect() only intended to perform cleanup when the primary +(control) interface is unbound. However, it currently relies on the +interface class to distinguish between control and data interfaces. +A malicious device could present a data interface with the same class +as the control interface, leading to premature cleanup and potential +use-after-free or double-free. + +Switch to verifying that the interface being disconnected is indeed +the control interface. + +Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") +Cc: stable@vger.kernel.org +Reported-by: Sashiko bot +Assisted-by: Gemini:gemini-3.1-pro +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/ims-pcu.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -2066,7 +2066,6 @@ err_free_mem: + static void ims_pcu_disconnect(struct usb_interface *intf) + { + struct ims_pcu *pcu = usb_get_intfdata(intf); +- struct usb_host_interface *alt = intf->cur_altsetting; + + usb_set_intfdata(intf, NULL); + +@@ -2074,7 +2073,7 @@ static void ims_pcu_disconnect(struct us + * See if we are dealing with control or data interface. The cleanup + * happens when we unbind primary (control) interface. + */ +- if (alt->desc.bInterfaceClass != USB_CLASS_COMM) ++ if (intf != pcu->ctrl_intf) + return; + + sysfs_remove_group(&intf->dev.kobj, &ims_pcu_attr_group); diff --git a/queue-5.10/input-ims-pcu-release-data-interface-on-disconnect.patch b/queue-5.10/input-ims-pcu-release-data-interface-on-disconnect.patch new file mode 100644 index 0000000000..6ee0a39cd8 --- /dev/null +++ b/queue-5.10/input-ims-pcu-release-data-interface-on-disconnect.patch @@ -0,0 +1,32 @@ +From 441c510a649c8ddce38aa0311334ed8bb546b36c Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 22 May 2026 10:22:55 -0700 +Subject: Input: ims-pcu - release data interface on disconnect + +From: Dmitry Torokhov + +commit 441c510a649c8ddce38aa0311334ed8bb546b36c upstream. + +During probe the driver claims the data interface, but it never releases +it. Release it in disconnect to avoid leaving it permanently claimed. + +Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") +Cc: stable@vger.kernel.org +Reported-by: Sashiko bot +Assisted-by: Gemini:gemini-3.1-pro +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/ims-pcu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -2086,6 +2086,7 @@ static void ims_pcu_disconnect(struct us + ims_pcu_destroy_application_mode(pcu); + + ims_pcu_buffers_free(pcu); ++ usb_driver_release_interface(&ims_pcu_driver, pcu->data_intf); + kfree(pcu); + } + diff --git a/queue-5.10/input-ims-pcu-validate-control-endpoint-type.patch b/queue-5.10/input-ims-pcu-validate-control-endpoint-type.patch new file mode 100644 index 0000000000..a1d3d8c3d8 --- /dev/null +++ b/queue-5.10/input-ims-pcu-validate-control-endpoint-type.patch @@ -0,0 +1,42 @@ +From baf56975806534268e24acf9a8abb1c447ce11e9 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 22 May 2026 10:29:26 -0700 +Subject: Input: ims-pcu - validate control endpoint type + +From: Dmitry Torokhov + +commit baf56975806534268e24acf9a8abb1c447ce11e9 upstream. + +The driver currently assumes that the first endpoint of the control +interface is an interrupt IN endpoint without verifying it. A malicious +device could provide a different endpoint type, which would then be +passed to usb_fill_int_urb(), potentially leading to kernel warnings +or undefined behavior. + +Verify that the control endpoint is an interrupt IN endpoint. + +Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") +Cc: stable@vger.kernel.org +Reported-by: Sashiko bot +Assisted-by: Gemini:gemini-3.1-pro +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/ims-pcu.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -1676,6 +1676,12 @@ static int ims_pcu_parse_cdc_data(struct + return -ENODEV; + + pcu->ep_ctrl = &alt->endpoint[0].desc; ++ if (!usb_endpoint_is_int_in(pcu->ep_ctrl)) { ++ dev_err(pcu->dev, ++ "Control endpoint is not INTERRUPT IN\n"); ++ return -EINVAL; ++ } ++ + pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl); + + pcu->data_intf = usb_ifnum_to_if(pcu->udev, diff --git a/queue-5.10/series b/queue-5.10/series index 6a8dd88a52..41eafecc10 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -516,3 +516,11 @@ dm-verity-increase-sprintf-buffer-size.patch scsi-hpsa-fix-dma-mapping-leak-on-ioaccel2-reset-path.patch scsi-sg-report-request-table-problems-when-any-status-is-set.patch scsi-target-core-fix-iscsi-isid-use-after-free-in-register-and-move.patch +input-ims-pcu-fix-use-after-free-and-double-free-in-disconnect.patch +input-ims-pcu-release-data-interface-on-disconnect.patch +input-ims-pcu-validate-control-endpoint-type.patch +input-ims-pcu-add-response-length-checks.patch +input-ims-pcu-fix-dma-mapping-violation-in-line-setup.patch +input-ims-pcu-fix-out-of-bounds-read-in-ims_pcu_irq-debug-logging.patch +input-ims-pcu-fix-potential-infinite-loop-in-cdc-union-descriptor-parsing.patch +input-ims-pcu-fix-type-confusion-in-cdc-union-descriptor-parsing.patch