From: Greg Kroah-Hartman Date: Mon, 27 Jan 2020 16:44:55 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.212~30 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2ef1ed8a0dfe6ffda05f300bbf0f5c2f48669981;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: input-aiptek-fix-endpoint-sanity-check.patch input-gtco-fix-endpoint-sanity-check.patch input-sur40-fix-interface-sanity-checks.patch --- diff --git a/queue-4.4/input-aiptek-fix-endpoint-sanity-check.patch b/queue-4.4/input-aiptek-fix-endpoint-sanity-check.patch new file mode 100644 index 00000000000..fe8aecc9fef --- /dev/null +++ b/queue-4.4/input-aiptek-fix-endpoint-sanity-check.patch @@ -0,0 +1,47 @@ +From 3111491fca4f01764e0c158c5e0f7ced808eef51 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Jan 2020 11:59:32 -0800 +Subject: Input: aiptek - fix endpoint sanity check + +From: Johan Hovold + +commit 3111491fca4f01764e0c158c5e0f7ced808eef51 upstream. + +The driver was checking the number of endpoints of the first alternate +setting instead of the current one, something which could lead to the +driver binding to an invalid interface. + +This in turn could cause the driver to misbehave or trigger a WARN() in +usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: 8e20cf2bce12 ("Input: aiptek - fix crash on detecting device without endpoints") +Signed-off-by: Johan Hovold +Acked-by: Vladis Dronov +Link: https://lore.kernel.org/r/20191210113737.4016-3-johan@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/tablet/aiptek.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/input/tablet/aiptek.c ++++ b/drivers/input/tablet/aiptek.c +@@ -1820,14 +1820,14 @@ aiptek_probe(struct usb_interface *intf, + input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0); + + /* Verify that a device really has an endpoint */ +- if (intf->altsetting[0].desc.bNumEndpoints < 1) { ++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) { + dev_err(&intf->dev, + "interface has %d endpoints, but must have minimum 1\n", +- intf->altsetting[0].desc.bNumEndpoints); ++ intf->cur_altsetting->desc.bNumEndpoints); + err = -EINVAL; + goto fail3; + } +- endpoint = &intf->altsetting[0].endpoint[0].desc; ++ endpoint = &intf->cur_altsetting->endpoint[0].desc; + + /* Go set up our URB, which is called when the tablet receives + * input. diff --git a/queue-4.4/input-gtco-fix-endpoint-sanity-check.patch b/queue-4.4/input-gtco-fix-endpoint-sanity-check.patch new file mode 100644 index 00000000000..b8866a7686c --- /dev/null +++ b/queue-4.4/input-gtco-fix-endpoint-sanity-check.patch @@ -0,0 +1,59 @@ +From a8eeb74df5a6bdb214b2b581b14782c5f5a0cf83 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Jan 2020 12:00:18 -0800 +Subject: Input: gtco - fix endpoint sanity check + +From: Johan Hovold + +commit a8eeb74df5a6bdb214b2b581b14782c5f5a0cf83 upstream. + +The driver was checking the number of endpoints of the first alternate +setting instead of the current one, something which could lead to the +driver binding to an invalid interface. + +This in turn could cause the driver to misbehave or trigger a WARN() in +usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: 162f98dea487 ("Input: gtco - fix crash on detecting device without endpoints") +Signed-off-by: Johan Hovold +Acked-by: Vladis Dronov +Link: https://lore.kernel.org/r/20191210113737.4016-5-johan@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/tablet/gtco.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/drivers/input/tablet/gtco.c ++++ b/drivers/input/tablet/gtco.c +@@ -876,18 +876,14 @@ static int gtco_probe(struct usb_interfa + } + + /* Sanity check that a device has an endpoint */ +- if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) { ++ if (usbinterface->cur_altsetting->desc.bNumEndpoints < 1) { + dev_err(&usbinterface->dev, + "Invalid number of endpoints\n"); + error = -EINVAL; + goto err_free_urb; + } + +- /* +- * The endpoint is always altsetting 0, we know this since we know +- * this device only has one interrupt endpoint +- */ +- endpoint = &usbinterface->altsetting[0].endpoint[0].desc; ++ endpoint = &usbinterface->cur_altsetting->endpoint[0].desc; + + /* Some debug */ + dev_dbg(&usbinterface->dev, "gtco # interfaces: %d\n", usbinterface->num_altsetting); +@@ -974,7 +970,7 @@ static int gtco_probe(struct usb_interfa + input_dev->dev.parent = &usbinterface->dev; + + /* Setup the URB, it will be posted later on open of input device */ +- endpoint = &usbinterface->altsetting[0].endpoint[0].desc; ++ endpoint = &usbinterface->cur_altsetting->endpoint[0].desc; + + usb_fill_int_urb(gtco->urbinfo, + gtco->usbdev, diff --git a/queue-4.4/input-sur40-fix-interface-sanity-checks.patch b/queue-4.4/input-sur40-fix-interface-sanity-checks.patch new file mode 100644 index 00000000000..ab79e52b6ac --- /dev/null +++ b/queue-4.4/input-sur40-fix-interface-sanity-checks.patch @@ -0,0 +1,37 @@ +From 6b32391ed675827f8425a414abbc6fbd54ea54fe Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Jan 2020 12:01:27 -0800 +Subject: Input: sur40 - fix interface sanity checks + +From: Johan Hovold + +commit 6b32391ed675827f8425a414abbc6fbd54ea54fe upstream. + +Make sure to use the current alternate setting when verifying the +interface descriptors to avoid binding to an invalid interface. + +This in turn could cause the driver to misbehave or trigger a WARN() in +usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: bdb5c57f209c ("Input: add sur40 driver for Samsung SUR40 (aka MS Surface 2.0/Pixelsense)") +Signed-off-by: Johan Hovold +Acked-by: Vladis Dronov +Link: https://lore.kernel.org/r/20191210113737.4016-8-johan@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/touchscreen/sur40.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/touchscreen/sur40.c ++++ b/drivers/input/touchscreen/sur40.c +@@ -496,7 +496,7 @@ static int sur40_probe(struct usb_interf + int error; + + /* Check if we really have the right interface. */ +- iface_desc = &interface->altsetting[0]; ++ iface_desc = interface->cur_altsetting; + if (iface_desc->desc.bInterfaceClass != 0xFF) + return -ENODEV; + diff --git a/queue-4.4/series b/queue-4.4/series index 042bf7dbc86..6d3746c6bf7 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -168,3 +168,6 @@ hwmon-adt7475-make-volt2reg-return-same-reg-as-reg2volt-input.patch input-keyspan-remote-fix-control-message-timeouts.patch arm-8950-1-ftrace-recordmcount-filter-relocation-types.patch mmc-sdhci-fix-minimum-clock-rate-for-v3-controller.patch +input-sur40-fix-interface-sanity-checks.patch +input-gtco-fix-endpoint-sanity-check.patch +input-aiptek-fix-endpoint-sanity-check.patch