This is a note to let you know that I've just added the patch titled
Input: pegasus-notetaker - check pipe type when probing
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
input-pegasus-notetaker-check-pipe-type-when-probing.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From b3d80fd27a3c2d8715a40cbf876139b56195f162 Mon Sep 17 00:00:00 2001
From: Soumya Negi <soumya.negi97@xxxxxxxxx>
Date: Sun, 9 Apr 2023 19:12:04 -0700
Subject: Input: pegasus-notetaker - check pipe type when probing
From: Soumya Negi <soumya.negi97@xxxxxxxxx>
commit b3d80fd27a3c2d8715a40cbf876139b56195f162 upstream.
Fix WARNING in pegasus_open/usb_submit_urb
Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13
Warning raised because pegasus_driver submits transfer request for
bogus URB (pipe type does not match endpoint type). Add sanity check at
probe time for pipe value extracted from endpoint descriptor. Probe
will fail if sanity check fails.
Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Soumya Negi <soumya.negi97@xxxxxxxxx>
Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@xxxxxxxxx
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/input/tablet/pegasus_notetaker.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/input/tablet/pegasus_notetaker.c
+++ b/drivers/input/tablet/pegasus_notetaker.c
@@ -296,6 +296,12 @@ static int pegasus_probe(struct usb_inte
pegasus->intf = intf;
pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
+ /* Sanity check that pipe's type matches endpoint's type */
+ if (usb_pipe_type_check(dev, pipe)) {
+ error = -EINVAL;
+ goto err_free_mem;
+ }
+
pegasus->data_len = usb_maxpacket(dev, pipe);
pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL,
Patches currently in stable-queue which might be from soumya.negi97@xxxxxxxxx are
queue-6.1/input-pegasus-notetaker-check-pipe-type-when-probing.patch
