linux.git/drivers/input/misc, branch v7.2-rc1

Input: remove changelogs

2026-06-10T18:04:17+00:00

There is no need to keep changelogs in driver sources, they are tracked
in git.

Signed-off-by: Elliot Tester 
Link: https://patch.msgid.link/20260514193302.117488-1-elliotctester1@gmail.com
Signed-off-by: Dmitry Torokhov

Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing

2026-06-07T04:05:17+00:00

The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc()
by iterating through the extra descriptor data. However, it does not
verify that the bLength of each descriptor is at least 2. A malicious
device could provide a descriptor with bLength = 0, leading to an
infinite loop in the driver.

Add a check to ensure bLength is at least 2 before proceeding with
parsing.

Fixes: 628329d52474 (Input: add IMS Passenger Control Unit driver)
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov

Input: ims-pcu - add response length checks

2026-06-07T04:05:16+00:00

The driver processes response data from device buffers without verifying
that the device actually sent enough data. This can lead to
out-of-bounds reads or processing stale data.

Add checks for the expected response length before accessing the
buffers.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot 
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov

Input: ims-pcu - fix DMA mapping violation in line setup

2026-06-07T04:05:16+00:00

In ims_pcu_line_setup(), the driver uses pcu->cmd_buf as a transfer
buffer for usb_control_msg(). However, pcu->cmd_buf is embedded in the
struct ims_pcu allocation, which violates DMA mapping rules regarding
cacheline alignment.

Use a heap-allocated buffer for the line coding data instead.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot 
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov

Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

2026-06-07T04:05:15+00:00

The debug logging in ims_pcu_irq() unconditionally prints data from
pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the
actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the
control URB exceeds pcu->max_in_size, this leads to an out-of-bounds
read.

Fix this by printing from the correct buffer associated with the URB.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot 
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov

Input: ims-pcu - validate control endpoint type

2026-06-07T04:05:14+00:00

The driver currently assumes that the first endpoint of the control
interface is an interrupt IN endpoint without verifying it. A malicious
device could provide a different endpoint type, which would then be
passed to usb_fill_int_urb(), potentially leading to kernel warnings
or undefined behavior.

Verify that the control endpoint is an interrupt IN endpoint.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot 
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov

Input: ims-pcu - fix race condition in reset_device sysfs callback

2026-06-07T04:05:13+00:00

The ims_pcu_reset_device() sysfs callback calls ims_pcu_execute_command()
without acquiring pcu->cmd_mutex. This can lead to data races and
corruption of the shared command buffer if triggered concurrently with
other commands.

Acquire pcu->cmd_mutex before calling ims_pcu_execute_command().

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot 
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov

Input: ims-pcu - fix firmware leak in async update

2026-06-07T04:05:13+00:00

The firmware object was not being released if validation failed.
Use __free(firmware) to ensure the firmware is always released.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot 
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov

Input: ims-pcu - fix type confusion in CDC union descriptor parsing

2026-06-07T04:03:34+00:00

The driver currently trusts the bMasterInterface0 from the CDC union
descriptor without verifying that it matches the interface being
probed. This could lead to the driver overwriting the private data of
another interface.

Validate that the control interface found in the descriptor is indeed
the one we are probing.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot 
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov

Input: ims-pcu - fix use-after-free and double-free in disconnect

2026-06-07T04:00:06+00:00

ims_pcu_disconnect() only intended to perform cleanup when the primary
(control) interface is unbound. However, it currently relies on the
interface class to distinguish between control and data interfaces.
A malicious device could present a data interface with the same class
as the control interface, leading to premature cleanup and potential
use-after-free or double-free.

Switch to verifying that the interface being disconnected is indeed
the control interface.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot 
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov