From b3d80fd27a3c2d8715a40cbf876139b56195f162 Mon Sep 17 00:00:00 2001 From: Soumya Negi Date: Sun, 9 Apr 2023 19:12:04 -0700 Subject: [PATCH 1/2] Input: pegasus-notetaker - check pipe type when probing Fix WARNING in pegasus_open/usb_submit_urb Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13 Warning raised because pegasus_driver submits transfer request for bogus URB (pipe type does not match endpoint type). Add sanity check at probe time for pipe value extracted from endpoint descriptor. Probe will fail if sanity check fails. Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com Signed-off-by: Soumya Negi Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@gmail.com Signed-off-by: Dmitry Torokhov --- drivers/input/tablet/pegasus_notetaker.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/input/tablet/pegasus_notetaker.c b/drivers/input/tablet/pegasus_notetaker.c index d836d3dcc6a24..a68da2988f9cd 100644 --- a/drivers/input/tablet/pegasus_notetaker.c +++ b/drivers/input/tablet/pegasus_notetaker.c @@ -296,6 +296,12 @@ static int pegasus_probe(struct usb_interface *intf, pegasus->intf = intf; pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress); + /* Sanity check that pipe's type matches endpoint's type */ + if (usb_pipe_type_check(dev, pipe)) { + error = -EINVAL; + goto err_free_mem; + } + pegasus->data_len = usb_maxpacket(dev, pipe); pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL, From 5dc63e56a9cf8df0b59c234a505a1653f1bdf885 Mon Sep 17 00:00:00 2001 From: hrdl Date: Thu, 13 Apr 2023 23:41:13 -0700 Subject: [PATCH 2/2] Input: cyttsp5 - fix sensing configuration data structure Prior to this patch, the sensing configuration data was not parsed correctly, breaking detection of max_tch. The vendor driver includes this field. This change informs the driver about the correct maximum number of simultaneous touch inputs. Tested on a Pine64 PineNote with a modified touch screen controller firmware. Signed-off-by: hrdl Reviewed-by: Alistair Francis Link: https://lore.kernel.org/r/20230411211651.3791304-1-git@hrdl.eu Signed-off-by: Dmitry Torokhov --- drivers/input/touchscreen/cyttsp5.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/touchscreen/cyttsp5.c b/drivers/input/touchscreen/cyttsp5.c index 16caffa35dd99..30102cb80fac8 100644 --- a/drivers/input/touchscreen/cyttsp5.c +++ b/drivers/input/touchscreen/cyttsp5.c @@ -111,6 +111,7 @@ struct cyttsp5_sensing_conf_data_dev { __le16 max_z; u8 origin_x; u8 origin_y; + u8 panel_id; u8 btn; u8 scan_mode; u8 max_num_of_tch_per_refresh_cycle;