Linux kernel source tree
Go to file
Javier Carrasco 2b9c3eb32a Input: bcm5974 - check endpoint type before starting traffic
syzbot has found a type mismatch between a USB pipe and the transfer
endpoint, which is triggered by the bcm5974 driver[1].

This driver expects the device to provide input interrupt endpoints and
if that is not the case, the driver registration should terminate.

Repros are available to reproduce this issue with a certain setup for
the dummy_hcd, leading to an interrupt/bulk mismatch which is caught in
the USB core after calling usb_submit_urb() with the following message:
"BOGUS urb xfer, pipe 1 != type 3"

Some other device drivers (like the appletouch driver bcm5974 is mainly
based on) provide some checking mechanism to make sure that an IN
interrupt endpoint is available. In this particular case the endpoint
addresses are provided by a config table, so the checking can be
targeted to the provided endpoints.

Add some basic checking to guarantee that the endpoints available match
the expected type for both the trackpad and button endpoints.

This issue was only found for the trackpad endpoint, but the checking
has been added to the button endpoint as well for the same reasons.

Given that there was never a check for the endpoint type, this bug has
been there since the first implementation of the driver (f89bd95c5c).

[1] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622

Fixes: f89bd95c5c ("Input: bcm5974 - add driver for Macbook Air and Pro Penryn touchpads")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-and-tested-by: syzbot+348331f63b034f89b622@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20231007-topic-bcm5974_bulk-v3-1-d0f38b9d2935@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2024-01-31 10:32:59 -08:00
arch Fix an FPU invalidation bug on exec(), and fix a performance 2023-08-26 10:57:29 -07:00
block block-6.5-2023-08-19 2023-08-19 17:31:46 +02:00
certs KEYS: Add missing function documentation 2023-04-24 16:15:52 +03:00
crypto crypto: fix uninit-value in af_alg_free_resources 2023-08-18 18:30:09 +08:00
Documentation dt-bindings: input: bindings for Adafruit Seesaw Gamepad 2024-01-09 23:45:18 -08:00
drivers Input: bcm5974 - check endpoint type before starting traffic 2024-01-31 10:32:59 -08:00
fs 18 hotfixes. 13 are cc:stable and the remainder pertain to post-6.4 issues 2023-08-25 11:44:43 -07:00
include Input: as5011 - convert to GPIO descriptor 2023-12-13 21:26:13 -08:00
init Kbuild updates for v6.5 2023-07-01 09:24:31 -07:00
io_uring io_uring/parisc: Adjust pgoff in io_uring mmap() for parisc 2023-08-08 12:37:01 -06:00
ipc Merge branch 'work.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2023-02-24 19:20:07 -08:00
kernel A last minute fix for a regression introduced in the v6.5 merge window. The 2023-08-26 10:34:29 -07:00
lib lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels 2023-08-25 13:22:10 -07:00
LICENSES LICENSES: Add the copyleft-next-0.3.1 license 2022-11-08 15:44:01 +01:00
mm 18 hotfixes. 13 are cc:stable and the remainder pertain to post-6.4 issues 2023-08-25 11:44:43 -07:00
net Networking fixes for 6.5-rc8, including fixes from wifi, can 2023-08-24 08:23:13 -07:00
rust rust: macros: vtable: fix HAS_* redefinition (gen_const_name) 2023-08-09 21:15:07 +02:00
samples samples: ftrace: Replace bti assembly with hint for older compiler 2023-08-21 22:03:58 -04:00
scripts Kbuild fixes for v6.5 (2nd) 2023-08-13 08:56:24 -07:00
security selinux/stable-6.5 PR 20230821 2023-08-22 10:38:29 -07:00
sound ASoC: Quirk for v6.5 2023-08-25 09:43:49 +02:00
tools 18 hotfixes. 13 are cc:stable and the remainder pertain to post-6.4 issues 2023-08-25 11:44:43 -07:00
usr initramfs: Encode dependency on KBUILD_BUILD_TIMESTAMP 2023-06-06 17:54:49 +09:00
virt KVM: Grab a reference to KVM for VM and vCPU stats file descriptors 2023-07-29 11:05:28 -04:00
.clang-format iommu: Add for_each_group_device() 2023-05-23 08:15:51 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore get_maintainer: add Alan to .get_maintainer.ignore 2022-08-20 15:17:44 -07:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore Revert ".gitignore: ignore *.cover and *.mbx" 2023-07-04 15:05:12 -07:00
.mailmap mailmap: add entries for Simon Horman 2023-08-16 09:53:10 +01:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS - Address -Wmissing-prototype warnings 2023-06-26 16:43:54 -07:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS Input: driver for Adafruit Seesaw Gamepad 2024-01-09 23:45:19 -08:00
Makefile Linux 6.5 2023-08-27 14:49:51 -07:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.