linux-stable.git/drivers/input/misc/ims-pcu.c, branch linux-3.12.y Linux kernel stable tree Input: ims-pcu - validate number of endpoints before using them 2017-04-07T08:38:24+00:00 Johan Hovold johan@kernel.org 2017-03-16T18:36:13+00:00 e542630d7dbc6f424d85d045a1f125ee4f009d66 commit 1916d319271664241b7aa0cd2b05e32bdb310ce9 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack control-interface endpoints. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> 
commit 1916d319271664241b7aa0cd2b05e32bdb310ce9 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack control-interface endpoints.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Input: ims-pcu - sanity check against missing interfaces 2016-04-11T14:44:25+00:00 Oliver Neukum oneukum@suse.com 2016-03-17T21:00:17+00:00 b18626baf7a8b5bef098204516641b0701419d85 commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff upstream. A malicious device missing interface can make the driver oops. Add sanity checking. Signed-off-by: Oliver Neukum <ONeukum@suse.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> 
commit a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff upstream.

A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Input: ims-pcu - fix a memory leak on error 2013-04-02T05:23:30+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2013-04-01T08:09:15+00:00 3c2b901003b4c152e19e6578c1705ce2c90edd4a Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: add IMS Passenger Control Unit driver 2013-03-12T15:50:22+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2013-02-02T19:26:13+00:00 628329d52474323938a03826941e166bc7c8eff4 The PCU is a device installed in the armrest of a plane seat and is connected to IMS Rave Entertainment System. It has a set of control buttons (Volume Up/Down, Attendant, Lights, etc) on one side and gamepad-like controls on the other side. Originally the device was handled from userspace and because of that it presents itself on USB bus as a CDC-ACM modem device that however can not make calls. However the custom handling is not as convenient as using standard input subsystem facilities. If it was pure input device it would be possible to continue using userspace solution (moving it over to uinput), but the device also has backlighted keys which can not be supported via uinput. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
The PCU is a device installed in the armrest of a plane seat and
is connected to IMS Rave Entertainment System. It has a set of control
buttons (Volume Up/Down, Attendant, Lights, etc) on one side and
gamepad-like controls on the other side.

Originally the device was handled from userspace and because of that
it presents itself on USB bus as a CDC-ACM modem device that however
can not make calls. However the custom handling is not as convenient
as using standard input subsystem facilities. If it was pure input
device it would be possible to continue using userspace solution
(moving it over to uinput), but the device also has backlighted keys
which can not be supported via uinput.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>