lkml.org 
[lkml]   [2020]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 067/104] Input: aiptek - fix endpoint sanity check
    Date
    From: Johan Hovold <johan@kernel.org>

    commit 3111491fca4f01764e0c158c5e0f7ced808eef51 upstream.

    The driver was checking the number of endpoints of the first alternate
    setting instead of the current one, something which could lead to the
    driver binding to an invalid interface.

    This in turn could cause the driver to misbehave or trigger a WARN() in
    usb_submit_urb() that kernels with panic_on_warn set would choke on.

    Fixes: 8e20cf2bce12 ("Input: aiptek - fix crash on detecting device without endpoints")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Acked-by: Vladis Dronov <vdronov@redhat.com>
    Link: https://lore.kernel.org/r/20191210113737.4016-3-johan@kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/input/tablet/aiptek.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    --- a/drivers/input/tablet/aiptek.c
    +++ b/drivers/input/tablet/aiptek.c
    @@ -1802,14 +1802,14 @@ aiptek_probe(struct usb_interface *intf,
    input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);

    /* Verify that a device really has an endpoint */
    - if (intf->altsetting[0].desc.bNumEndpoints < 1) {
    + if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
    dev_err(&intf->dev,
    "interface has %d endpoints, but must have minimum 1\n",
    - intf->altsetting[0].desc.bNumEndpoints);
    + intf->cur_altsetting->desc.bNumEndpoints);
    err = -EINVAL;
    goto fail3;
    }
    - endpoint = &intf->altsetting[0].endpoint[0].desc;
    + endpoint = &intf->cur_altsetting->endpoint[0].desc;

    /* Go set up our URB, which is called when the tablet receives
    * input.

    \
     
     \ /
      Last update: 2020-01-28 15:04    [W:4.075 / U:0.272 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site