On 05.03.24 06:52, Javier Carrasco wrote: > This patch intended to fix an well-knonw issue in old drivers where the > endpoint type is taken for granted, which is often triggered by fuzzers. > > That was the case for this driver [1], and although the fix seems to be > correct, it uncovered another issue that leads to a regression [2] if > the endpoints of the current interface are checked. The driver makes use > of endpoints that belong to a different interface rather than the one it > binds (it binds to the third interface, but also accesses an endpoint > from a different one). The driver should claim the interfaces it > requires, but that is still not the case. > > Given that the regression is more severe than the issue found by > syzkaller, the best approach is reverting the patch that causes the > regression, and trying to fix the underlying problem before checking > the endpoint types again. > > Note that reverting this patch will probably trigger the syzkaller bug > at some point. >> [1] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 > [2] https://lore.kernel.org/linux-input/ab9d758c-3ce9-42f6-99af-877055a589e6@xxxxxxxxxxxxx/T/#t FWIW, these should be Link: or Closes tags, as explained in the docs. And there is a better lore link. And there is the bugzilla entry as well. Hence... > This reverts commit 2b9c3eb32a699acdd4784d6b93743271b4970899. > > Fixes: b516b1b0dfcc ("Revert "Input: bcm5974 - check endpoint type before starting traffic"") you might want to add them here like this: Link: https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 [1] Link: https://lore.kernel.org/linux-input/87sf161jjc.wl-tiwai@xxxxxxx/ [2] Link: https://bugzilla.suse.com/show_bug.cgi?id=1220030 In an ideal world we also would add a "Reported-by: Jacopo Radice" before the bugzilla line, as the details in the suse bugtracker apparently is public, but it's likely better to not go down that path. > Signed-off-by: Javier Carrasco <javier.carrasco.cruz@xxxxxxxxx> Ciao, Thorsten
