linux-stable.git/drivers/input/misc/ims-pcu.c, branch linux-4.9.y Linux kernel stable tree Input: ims-psu - check if CDC union descriptor is sane 2017-11-18T10:22:24+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2017-10-07T18:07:47+00:00 9d65d0ea55dcb813cea7df05602f233ad4843baf commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream. Before trying to use CDC union descriptor, try to validate whether that it is sane by checking that intf->altsetting->extra is big enough and that descriptor bLength is not too big and not too small. Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream.

Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: ims-pcu - validate number of endpoints before using them 2017-03-30T07:41:22+00:00 Johan Hovold johan@kernel.org 2017-03-16T18:36:13+00:00 1f5a512844a85690df614db3a6d8dbb54e662391 commit 1916d319271664241b7aa0cd2b05e32bdb310ce9 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack control-interface endpoints. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 1916d319271664241b7aa0cd2b05e32bdb310ce9 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack control-interface endpoints.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: ims-pcu - sanity check against missing interfaces 2016-03-17T21:16:57+00:00 Oliver Neukum oneukum@suse.com 2016-03-17T21:00:17+00:00 a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff A malicious device missing interface can make the driver oops. Add sanity checking. Signed-off-by: Oliver Neukum <ONeukum@suse.com> CC: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 Merge branch 'next' into for-linus 2014-12-16T04:32:42+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2014-12-16T04:32:42+00:00 f20c86cd75f1c8c728dafd0218645ff3c5e8545d Prepare input updates for 3.19. 
Prepare input updates for 3.19.
Input: initialize device counter variables with -1 2014-12-03T23:27:17+00:00 Aniroop Mathur aniroop.mathur@gmail.com 2014-12-03T22:27:42+00:00 939ffb1712890ee22146d2dfc24adbc7da6afa84 Let's initialize atomic_t variables keeping track of number of various devices created so far with -1 in order to avoid extra subtraction operation. Signed-off-by: Aniroop Mathur <aniroop.mathur@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Let's initialize atomic_t variables keeping track of number of various
devices created so far with -1 in order to avoid extra subtraction
operation.

Signed-off-by: Aniroop Mathur <aniroop.mathur@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix dead code in ims_pcu_ofn_reg_addr_store() 2014-10-28T17:33:36+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2014-10-24T22:10:47+00:00 60183a6e93ac62727161d1a94abd80e2d7d901d0 Coverity pointed out that at return point error is always 0 so the conditional is not needed. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Coverity pointed out that at return point error is always 0 so the
conditional is not needed.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix uninitialized use of 'error' in ims_pcu_buffers_alloc() 2014-05-19T05:39:56+00:00 Christian Engelmayer cengelma@gmx.at 2014-05-18T23:00:40+00:00 19318de1daf25aa1ca4fe76e1d7ac834f1bfb0c4 In case allocation via usb_alloc_coherent() fails in ims_pcu_buffers_alloc(), the function jumps to the exit path without initializing local variable 'error' that is used as return value. Detected by Coverity - CID 1016531. Signed-off-by: Christian Engelmayer <cengelma@gmx.at> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
In case allocation via usb_alloc_coherent() fails in ims_pcu_buffers_alloc(),
the function jumps to the exit path without initializing local variable
'error' that is used as return value. Detected by Coverity - CID 1016531.

Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - add commands supported by the new version of the FW 2014-02-12T23:09:48+00:00 Andrey Smirnov andrew.smirnov@gmail.com 2014-02-12T23:02:14+00:00 e5fcd269c4599c4d224333b20e3ffd5e910d4db3 New version of the PCU firmware supports two new commands: - IMS_PCU_CMD_OFN_SET_CONFIG which allows to write data to the registers of one finger navigation(OFN) chip present on the device - IMS_PCU_CMD_OFN_GET_CONFIG which allows to read data form the registers of said chip. This commit adds two helper functions to use those commands and sysfs attributes to use them. It also exposes some OFN configuration parameters via sysfs. Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
New version of the PCU firmware supports two new commands:
  - IMS_PCU_CMD_OFN_SET_CONFIG which allows to write data to the
  registers of one finger navigation(OFN) chip present on the device
  - IMS_PCU_CMD_OFN_GET_CONFIG which allows to read data form the
  registers of said chip.

This commit adds two helper functions to use those commands and sysfs
attributes to use them. It also exposes some OFN configuration
parameters via sysfs.

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix error unwinding path in application mode 2014-02-12T23:09:40+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2014-01-04T04:54:37+00:00 ad7647d92f61c6e78bf6dc3804da1e2acf0515b6 We first create backlight and then input devices so we should destroy them in opposite order when handling errors. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
We first create backlight and then input devices so we should destroy them
in opposite order when handling errors.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix a memory leak on error 2013-04-02T05:23:30+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2013-04-01T08:09:15+00:00 3c2b901003b4c152e19e6578c1705ce2c90edd4a Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>