linux-stable.git/drivers/input/misc/ims-pcu.c, branch linux-5.4.y Linux kernel stable tree Input: ims-pcu - check record size in ims_pcu_flash_firmware() 2025-06-27T10:02:51+00:00 Dan Carpenter dan.carpenter@linaro.org 2025-05-30T23:13:32+00:00 c1b9d140b0807c6aee4bb53e1bfa4e391e3dc204 commit a95ef0199e80f3384eb992889322957d26c00102 upstream. The "len" variable comes from the firmware and we generally do trust firmware, but it's always better to double check. If the "len" is too large it could result in memory corruption when we do "memcpy(fragment->data, rec->data, len);" Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/131fd1ae92c828ee9f4fa2de03d8c210ae1f3524.1748463049.git.dan.carpenter@linaro.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit a95ef0199e80f3384eb992889322957d26c00102 upstream.

The "len" variable comes from the firmware and we generally do
trust firmware, but it's always better to double check.  If the "len"
is too large it could result in memory corruption when we do
"memcpy(fragment->data, rec->data, len);"

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/131fd1ae92c828ee9f4fa2de03d8c210ae1f3524.1748463049.git.dan.carpenter@linaro.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: ims-pcu - fix printf string overflow 2024-06-16T11:28:43+00:00 Arnd Bergmann arnd@arndb.de 2024-03-28T20:28:56+00:00 33d148cdb16333949eadaa6212d3e4f0d3b26737 [ Upstream commit bf32bceedd0453c70d9d022e2e29f98e446d7161 ] clang warns about a string overflow in this driver drivers/input/misc/ims-pcu.c:1802:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation] drivers/input/misc/ims-pcu.c:1814:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation] Make the buffer a little longer to ensure it always fits. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20240326223825.4084412-7-arnd@kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit bf32bceedd0453c70d9d022e2e29f98e446d7161 ]

clang warns about a string overflow in this driver

drivers/input/misc/ims-pcu.c:1802:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation]
drivers/input/misc/ims-pcu.c:1814:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation]

Make the buffer a little longer to ensure it always fits.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20240326223825.4084412-7-arnd@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19T15:09:55+00:00 Thomas Gleixner tglx@linutronix.de 2019-06-04T08:11:33+00:00 d2912cb15bdda8ba4a5dd73396ad62641af2f520 Based on 2 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation # extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 4122 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Enrico Weigelt <info@metux.net> Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Allison Randal <allison@lohutok.net> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Based on 2 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license version 2 as
  published by the free software foundation

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license version 2 as
  published by the free software foundation #

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 4122 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Enrico Weigelt <info@metux.net>
Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: ims-pcu - switch to using brightness_set_blocking() 2019-02-17T05:39:42+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2019-02-05T22:21:45+00:00 6b65189a2d09e0821c80581455b748c23c9342e9 Now that LEDs core allows "blocking" flavor of "set brightness" method we can use it and get rid of private work item. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Now that LEDs core allows "blocking" flavor of "set brightness" method we
can use it and get rid of private work item.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 Input: ims-pcu - fix typo in the error message 2017-11-27T00:16:31+00:00 Zhen Lei thunder.leizhen@huawei.com 2017-11-25T23:48:32+00:00 5ddc3c656bfb5c90d0196ff72b908d0343fef85e 1. change "to" to "too". 2. move ")" to the front of "\n", which discovered by Joe Perches. Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Reviewed-by: Joe Perches <joe@perches.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
1. change "to" to "too".
2. move ")" to the front of "\n", which discovered by Joe Perches.

Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Joe Perches <joe@perches.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 Input: ims-psu - check if CDC union descriptor is sane 2017-10-20T00:20:06+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2017-10-07T18:07:47+00:00 ea04efee7635c9120d015dcdeeeb6988130cb67a Before trying to use CDC union descriptor, try to validate whether that it is sane by checking that intf->altsetting->extra is big enough and that descriptor bLength is not too big and not too small. Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 Input: ims-pcu - constify attribute_group structures 2017-07-12T21:18:29+00:00 Arvind Yadav arvind.yadav.cs@gmail.com 2017-07-11T03:18:03+00:00 b06ae14803a264a61fa4c9fbb6a2304c78851bac attribute_groups are not supposed to change at runtime. All functions working with attribute_groups provided by <linux/sysfs.h> work with const attribute_group. So mark the non-const structs as const. File size before: text data bss dec hex filename 13547 1600 0 15147 3b2b drivers/input/misc/ims-pcu.o File size After adding 'const': text data bss dec hex filename 13675 1472 0 15147 3b2b drivers/input/misc/ims-pcu.o Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
attribute_groups are not supposed to change at runtime. All functions
working with attribute_groups provided by <linux/sysfs.h> work with const
attribute_group. So mark the non-const structs as const.

File size before:
   text	   data	    bss	    dec	    hex	filename
  13547	   1600	      0	  15147	   3b2b	drivers/input/misc/ims-pcu.o

File size After adding 'const':
   text	   data	    bss	    dec	    hex	filename
  13675	   1472	      0	  15147	   3b2b	drivers/input/misc/ims-pcu.o

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 Input: ims-pcu - validate number of endpoints before using them 2017-03-16T20:56:51+00:00 Johan Hovold johan@kernel.org 2017-03-16T18:36:13+00:00 1916d319271664241b7aa0cd2b05e32bdb310ce9 Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack control-interface endpoints. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Signed-off-by: Johan Hovold <johan@kernel.org> Cc: stable@vger.kernel.org # 3.10 Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack control-interface endpoints.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Cc: stable@vger.kernel.org	# 3.10
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 Input: ims-pcu - sanity check against missing interfaces 2016-03-17T21:16:57+00:00 Oliver Neukum oneukum@suse.com 2016-03-17T21:00:17+00:00 a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff A malicious device missing interface can make the driver oops. Add sanity checking. Signed-off-by: Oliver Neukum <ONeukum@suse.com> CC: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> 
A malicious device missing interface can make the driver oops.
Add sanity checking.

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 Merge branch 'next' into for-linus 2014-12-16T04:32:42+00:00 Dmitry Torokhov dmitry.torokhov@gmail.com 2014-12-16T04:32:42+00:00 f20c86cd75f1c8c728dafd0218645ff3c5e8545d Prepare input updates for 3.19. 
Prepare input updates for 3.19.