Drop input-bcm5974-check-endpoint-type-before-starting-tr.patch

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-6.1/input-bcm5974-check-endpoint-type-before-starting-tr.patch b/queue-6.1/input-bcm5974-check-endpoint-type-before-starting-tr.patch
deleted file mode 100644 (file)
index e87bead..0000000
--- a/queue-6.1/input-bcm5974-check-endpoint-type-before-starting-tr.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From 7a657bc8aefd38591aa4992b226a4e5dbdc65d03 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 14 Oct 2023 12:20:15 +0200
-Subject: Input: bcm5974 - check endpoint type before starting traffic
-
-From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
-
-[ Upstream commit 2b9c3eb32a699acdd4784d6b93743271b4970899 ]
-
-syzbot has found a type mismatch between a USB pipe and the transfer
-endpoint, which is triggered by the bcm5974 driver[1].
-
-This driver expects the device to provide input interrupt endpoints and
-if that is not the case, the driver registration should terminate.
-
-Repros are available to reproduce this issue with a certain setup for
-the dummy_hcd, leading to an interrupt/bulk mismatch which is caught in
-the USB core after calling usb_submit_urb() with the following message:
-"BOGUS urb xfer, pipe 1 != type 3"
-
-Some other device drivers (like the appletouch driver bcm5974 is mainly
-based on) provide some checking mechanism to make sure that an IN
-interrupt endpoint is available. In this particular case the endpoint
-addresses are provided by a config table, so the checking can be
-targeted to the provided endpoints.
-
-Add some basic checking to guarantee that the endpoints available match
-the expected type for both the trackpad and button endpoints.
-
-This issue was only found for the trackpad endpoint, but the checking
-has been added to the button endpoint as well for the same reasons.
-
-Given that there was never a check for the endpoint type, this bug has
-been there since the first implementation of the driver (f89bd95c5c94).
-
-[1] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622
-
-Fixes: f89bd95c5c94 ("Input: bcm5974 - add driver for Macbook Air and Pro Penryn touchpads")
-Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
-Reported-and-tested-by: syzbot+348331f63b034f89b622@syzkaller.appspotmail.com
-Link: https://lore.kernel.org/r/20231007-topic-bcm5974_bulk-v3-1-d0f38b9d2935@gmail.com
-Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/input/mouse/bcm5974.c | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
-index ca150618d32f1..953992b458e9f 100644
---- a/drivers/input/mouse/bcm5974.c
-+++ b/drivers/input/mouse/bcm5974.c
-@@ -19,6 +19,7 @@
-  * Copyright (C) 2006    Nicolas Boichat (nicolas@boichat.ch)
-  */
- 
-+#include "linux/usb.h"
- #include <linux/kernel.h>
- #include <linux/errno.h>
- #include <linux/slab.h>
-@@ -193,6 +194,8 @@ enum tp_type {
- 
- /* list of device capability bits */
- #define HAS_INTEGRATED_BUTTON 1
-+/* maximum number of supported endpoints (currently trackpad and button) */
-+#define MAX_ENDPOINTS 2
- 
- /* trackpad finger data block size */
- #define FSIZE_TYPE1           (14 * sizeof(__le16))
-@@ -891,6 +894,18 @@ static int bcm5974_resume(struct usb_interface *iface)
-       return error;
- }
- 
-+static bool bcm5974_check_endpoints(struct usb_interface *iface,
-+                                  const struct bcm5974_config *cfg)
-+{
-+      u8 ep_addr[MAX_ENDPOINTS + 1] = {0};
-+
-+      ep_addr[0] = cfg->tp_ep;
-+      if (cfg->tp_type == TYPE1)
-+              ep_addr[1] = cfg->bt_ep;
-+
-+      return usb_check_int_endpoints(iface, ep_addr);
-+}
-+
- static int bcm5974_probe(struct usb_interface *iface,
-                        const struct usb_device_id *id)
- {
-@@ -903,6 +918,11 @@ static int bcm5974_probe(struct usb_interface *iface,
-       /* find the product index */
-       cfg = bcm5974_get_config(udev);
- 
-+      if (!bcm5974_check_endpoints(iface, cfg)) {
-+              dev_err(&iface->dev, "Unexpected non-int endpoint\n");
-+              return -ENODEV;
-+      }
-+
-       /* allocate memory for our device state and initialize it */
-       dev = kzalloc(sizeof(struct bcm5974), GFP_KERNEL);
-       input_dev = input_allocate_device();
--- 
-2.43.0
-

diff --git a/queue-6.1/series b/queue-6.1/series
index 98c15783032776d007186c97f7dc6584b46142ec..2de5cdb80a150410a4d72a6d6fb2576fafbb2e70 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -55,7 +55,6 @@ squashfs-squashfs_read_data-need-to-check-if-the-len.patch
 squashfs-fix-variable-overflow-triggered-by-sysbot.patch
 reiserfs-fix-uninit-value-in-comp_keys.patch
 erofs-avoid-debugging-output-for-de-compressed-data.patch
-input-bcm5974-check-endpoint-type-before-starting-tr.patch
 quota-detect-loops-in-quota-tree.patch
 net-rds-fix-possible-deadlock-in-rds_message_put.patch
 net-sctp-fix-skb-leak-in-sctp_inq_free.patch