Skip to content

Commit 7105e92

Browse files
javiercarrascocruzdtor
authored andcommitted
Revert "Input: bcm5974 - check endpoint type before starting traffic"
This patch intended to fix an well-knonw issue in old drivers where the endpoint type is taken for granted, which is often triggered by fuzzers. That was the case for this driver [1], and although the fix seems to be correct, it uncovered another issue that leads to a regression [2], if the endpoints of the current interface are checked. The driver makes use of endpoints that belong to a different interface rather than the one it binds (it binds to the third interface, but also accesses an endpoint from a different one). The driver should claim the interfaces it requires, but that is still not the case. Given that the regression is more severe than the issue found by syzkaller, the best approach is reverting the patch that causes the regression, and trying to fix the underlying problem before checking the endpoint types again. Note that reverting this patch will probably trigger the syzkaller bug at some point. This reverts commit 2b9c3eb. Link: https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 [1] Link: https://lore.kernel.org/linux-input/87sf161jjc.wl-tiwai@suse.de/ [2] Fixes: 2b9c3eb ("Input: bcm5974 - check endpoint type before starting traffic") Reported-by: Jacopo Radice <jacopo.radice@outlook.com> Closes: https://bugzilla.suse.com/show_bug.cgi?id=1220030 Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com> Link: https://lore.kernel.org/r/20240305-revert_bcm5974_ep_check-v3-1-527198cf6499@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
1 parent dd50f77 commit 7105e92

File tree

1 file changed

+0
-20
lines changed

1 file changed

+0
-20
lines changed

drivers/input/mouse/bcm5974.c

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
* Copyright (C) 2006 Nicolas Boichat (nicolas@boichat.ch)
2020
*/
2121

22-
#include "linux/usb.h"
2322
#include <linux/kernel.h>
2423
#include <linux/errno.h>
2524
#include <linux/slab.h>
@@ -194,8 +193,6 @@ enum tp_type {
194193

195194
/* list of device capability bits */
196195
#define HAS_INTEGRATED_BUTTON 1
197-
/* maximum number of supported endpoints (currently trackpad and button) */
198-
#define MAX_ENDPOINTS 2
199196

200197
/* trackpad finger data block size */
201198
#define FSIZE_TYPE1 (14 * sizeof(__le16))
@@ -894,18 +891,6 @@ static int bcm5974_resume(struct usb_interface *iface)
894891
return error;
895892
}
896893

897-
static bool bcm5974_check_endpoints(struct usb_interface *iface,
898-
const struct bcm5974_config *cfg)
899-
{
900-
u8 ep_addr[MAX_ENDPOINTS + 1] = {0};
901-
902-
ep_addr[0] = cfg->tp_ep;
903-
if (cfg->tp_type == TYPE1)
904-
ep_addr[1] = cfg->bt_ep;
905-
906-
return usb_check_int_endpoints(iface, ep_addr);
907-
}
908-
909894
static int bcm5974_probe(struct usb_interface *iface,
910895
const struct usb_device_id *id)
911896
{
@@ -918,11 +903,6 @@ static int bcm5974_probe(struct usb_interface *iface,
918903
/* find the product index */
919904
cfg = bcm5974_get_config(udev);
920905

921-
if (!bcm5974_check_endpoints(iface, cfg)) {
922-
dev_err(&iface->dev, "Unexpected non-int endpoint\n");
923-
return -ENODEV;
924-
}
925-
926906
/* allocate memory for our device state and initialize it */
927907
dev = kzalloc(sizeof(struct bcm5974), GFP_KERNEL);
928908
input_dev = input_allocate_device();

0 commit comments

Comments
 (0)