From: Sasha Levin Date: Fri, 23 Aug 2024 12:38:20 +0000 (-0400) Subject: Drop input-bcm5974-check-endpoint-type-before-starting-tr.patch X-Git-Tag: v6.1.107~74 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8c9ecd7b1f49a9219379e257aed811d7c9cdc36d;p=thirdparty%2Fkernel%2Fstable-queue.git Drop input-bcm5974-check-endpoint-type-before-starting-tr.patch Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/input-bcm5974-check-endpoint-type-before-starting-tr.patch b/queue-6.1/input-bcm5974-check-endpoint-type-before-starting-tr.patch deleted file mode 100644 index e87beaddd96..00000000000 --- a/queue-6.1/input-bcm5974-check-endpoint-type-before-starting-tr.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 7a657bc8aefd38591aa4992b226a4e5dbdc65d03 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 14 Oct 2023 12:20:15 +0200 -Subject: Input: bcm5974 - check endpoint type before starting traffic - -From: Javier Carrasco - -[ Upstream commit 2b9c3eb32a699acdd4784d6b93743271b4970899 ] - -syzbot has found a type mismatch between a USB pipe and the transfer -endpoint, which is triggered by the bcm5974 driver[1]. - -This driver expects the device to provide input interrupt endpoints and -if that is not the case, the driver registration should terminate. - -Repros are available to reproduce this issue with a certain setup for -the dummy_hcd, leading to an interrupt/bulk mismatch which is caught in -the USB core after calling usb_submit_urb() with the following message: -"BOGUS urb xfer, pipe 1 != type 3" - -Some other device drivers (like the appletouch driver bcm5974 is mainly -based on) provide some checking mechanism to make sure that an IN -interrupt endpoint is available. In this particular case the endpoint -addresses are provided by a config table, so the checking can be -targeted to the provided endpoints. - -Add some basic checking to guarantee that the endpoints available match -the expected type for both the trackpad and button endpoints. - -This issue was only found for the trackpad endpoint, but the checking -has been added to the button endpoint as well for the same reasons. - -Given that there was never a check for the endpoint type, this bug has -been there since the first implementation of the driver (f89bd95c5c94). - -[1] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 - -Fixes: f89bd95c5c94 ("Input: bcm5974 - add driver for Macbook Air and Pro Penryn touchpads") -Signed-off-by: Javier Carrasco -Reported-and-tested-by: syzbot+348331f63b034f89b622@syzkaller.appspotmail.com -Link: https://lore.kernel.org/r/20231007-topic-bcm5974_bulk-v3-1-d0f38b9d2935@gmail.com -Signed-off-by: Dmitry Torokhov -Signed-off-by: Sasha Levin ---- - drivers/input/mouse/bcm5974.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c -index ca150618d32f1..953992b458e9f 100644 ---- a/drivers/input/mouse/bcm5974.c -+++ b/drivers/input/mouse/bcm5974.c -@@ -19,6 +19,7 @@ - * Copyright (C) 2006 Nicolas Boichat (nicolas@boichat.ch) - */ - -+#include "linux/usb.h" - #include - #include - #include -@@ -193,6 +194,8 @@ enum tp_type { - - /* list of device capability bits */ - #define HAS_INTEGRATED_BUTTON 1 -+/* maximum number of supported endpoints (currently trackpad and button) */ -+#define MAX_ENDPOINTS 2 - - /* trackpad finger data block size */ - #define FSIZE_TYPE1 (14 * sizeof(__le16)) -@@ -891,6 +894,18 @@ static int bcm5974_resume(struct usb_interface *iface) - return error; - } - -+static bool bcm5974_check_endpoints(struct usb_interface *iface, -+ const struct bcm5974_config *cfg) -+{ -+ u8 ep_addr[MAX_ENDPOINTS + 1] = {0}; -+ -+ ep_addr[0] = cfg->tp_ep; -+ if (cfg->tp_type == TYPE1) -+ ep_addr[1] = cfg->bt_ep; -+ -+ return usb_check_int_endpoints(iface, ep_addr); -+} -+ - static int bcm5974_probe(struct usb_interface *iface, - const struct usb_device_id *id) - { -@@ -903,6 +918,11 @@ static int bcm5974_probe(struct usb_interface *iface, - /* find the product index */ - cfg = bcm5974_get_config(udev); - -+ if (!bcm5974_check_endpoints(iface, cfg)) { -+ dev_err(&iface->dev, "Unexpected non-int endpoint\n"); -+ return -ENODEV; -+ } -+ - /* allocate memory for our device state and initialize it */ - dev = kzalloc(sizeof(struct bcm5974), GFP_KERNEL); - input_dev = input_allocate_device(); --- -2.43.0 - diff --git a/queue-6.1/series b/queue-6.1/series index 98c15783032..2de5cdb80a1 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -55,7 +55,6 @@ squashfs-squashfs_read_data-need-to-check-if-the-len.patch squashfs-fix-variable-overflow-triggered-by-sysbot.patch reiserfs-fix-uninit-value-in-comp_keys.patch erofs-avoid-debugging-output-for-de-compressed-data.patch -input-bcm5974-check-endpoint-type-before-starting-tr.patch quota-detect-loops-in-quota-tree.patch net-rds-fix-possible-deadlock-in-rds_message_put.patch net-sctp-fix-skb-leak-in-sctp_inq_free.patch