Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1358426

[PATCH 4.2.y-ckt 04/98] Input: aiptek - fix crash on detecting device without endpoints

Show all headers | View raw

4.2.8-ckt6 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Vladis Dronov <vdronov@redhat.com>

commit 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96 upstream.

The aiptek driver crashes in aiptek_probe() when a specially crafted USB
device without endpoints is detected. This fix adds a check that the device
has proper configuration expected by the driver. Also an error return value
is changed to more matching one in one of the error paths.

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/input/tablet/aiptek.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index e7f966d..78ca448 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -1819,6 +1819,14 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0);
 	input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
 
+	/* Verify that a device really has an endpoint */
+	if (intf->altsetting[0].desc.bNumEndpoints < 1) {
+		dev_err(&intf->dev,
+			"interface has %d endpoints, but must have minimum 1\n",
+			intf->altsetting[0].desc.bNumEndpoints);
+		err = -EINVAL;
+		goto fail3;
+	}
 	endpoint = &intf->altsetting[0].endpoint[0].desc;
 
 	/* Go set up our URB, which is called when the tablet receives
@@ -1861,6 +1869,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	if (i == ARRAY_SIZE(speeds)) {
 		dev_info(&intf->dev,
 			 "Aiptek tried all speeds, no sane response\n");
+		err = -EINVAL;
 		goto fail3;
 	}
 
-- 
2.7.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[4.2.y-ckt stable] Linux 4.2.8-ckt6 stable review Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 21/98] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 87/98] tcp: fix tcpi_segs_in after connection establishment Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 65/98] ovl: fix getcwd() failure after unsuccessful rmdir Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 89/98] tcp: convert cached rtt from usec to jiffies when feeding initial rto Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 08/98] mac80211: minstrel: Change expected throughput unit back to Kbps Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 88/98] be2net: Don't leak iomapped memory on removal. Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 83/98] MIPS: Fix build error when SMP is used without GIC Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 93/98] ipv6: re-enable fragment header matching in ipv6_find_hdr Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 82/98] dmaengine: at_xdmac: fix residue computation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 60/98] drm/radeon/pm: update current crtc info after setting the powerstate Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 85/98] dmaengine: pxa_dma: fix cyclic transfers Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 37/98] arm/arm64: KVM: Fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 94/98] net/mlx5e: Remove wrong poll CQ optimization Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 77/98] jffs2: reduce the breakage on recovery from halfway failed rename() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 86/98] MIPS: smp.c: Fix uninitialised temp_foreign_map Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 98/98] mld, igmp: Fix reserved tailroom calculation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:40 +0100
  [PATCH 4.2.y-ckt 63/98] ALSA: hda - Fix mic issues on Acer Aspire E1-472 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 76/98] ncpfs: fix a braino in OOM handling in ncp_fill_cache() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 70/98] target: Drop incorrect ABORT_TASK put for completed commands Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 58/98] USB: qcserial: add Sierra Wireless EM74xx device ID Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 50/98] USB: serial: option: add support for Quectel UC20 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 79/98] arm64: account for sparsemem section alignment when choosing vmemmap offset Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 61/98] drm/amdgpu: return from atombios_dp_get_dpcd only when error Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 80/98] tracing: Fix check for cpu online when event is disabled Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 47/98] ASoC: wm8994: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 44/98] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 45/98] ASoC: dapm: Fix ctl value accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 57/98] drm/ast: Fix incorrect register check for DRAM width Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 46/98] ASoC: wm8958: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 49/98] USB: serial: option: add support for Telit LE922 PID 0x1045 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 59/98] drm/amdgpu/pm: update current crtc info after setting the powerstate Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 48/98] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 42/98] use ->d_seq to get coherency between ->d_inode and ->d_flags Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 54/98] i2c: brcmstb: allocate correct amount of memory for regmap Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 56/98] parisc: Fix ptrace syscall number and return value modification Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 66/98] ovl: ignore lower entries when checking purity of non-directory entries Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 51/98] ALSA: usb-audio: Add a quirk for Plantronics DA45 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 72/98] ARM: dts: dra7: do not gate cpsw clock due to errata i877 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 43/98] USB: qcserial: add Dell Wireless 5809e Gobi 4G HSPA+ (rev3) Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 78/98] KVM: VMX: disable PEBS before a guest entry Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 68/98] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 71/98] ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 62/98] PM / sleep / x86: Fix crash on graph trace through x86 suspend Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 55/98] ALSA: seq: oss: Don't drain at closing a client Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 73/98] PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 41/98] ALSA: hdsp: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 52/98] mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 81/98] KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo Kamal Mostafa <kamal@canonical.com> - 2016-03-16 00:50 +0100
  [PATCH 4.2.y-ckt 29/98] ALSA: ctl: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 26/98] KVM: x86: fix root cause for missed hardware breakpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 10/98] iwlwifi: mvm: inc pending frames counter also when txing non-sta Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 35/98] CIFS: Fix SMB2+ interim response processing for read requests Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 16/98] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 02/98] tipc: fix nullptr crash during subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 09/98] libata: fix HDIO_GET_32BIT ioctl Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 39/98] ALSA: hdspm: Fix wrong boolean ctl value accesses Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 18/98] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 27/98] arm64: vmemmap: use virtual projection of linear region Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 06/98] cfg80211/wext: fix message ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 34/98] cifs: fix out-of-bounds access in lease parsing Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 40/98] ALSA: hdspm: Fix zero-division Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 22/98] iommu/amd: Apply workaround for ATS write permission check Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 13/98] ahci: Order SATA device IDs for codename Lewisburg Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 04/98] Input: aiptek - fix crash on detecting device without endpoints Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 01/98] tipc: fix connection abort during subscription cancel Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 31/98] ALSA: rawmidi: Fix ioctls X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 14/98] Adding Intel Lewisburg device IDs for SATA Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 05/98] wext: fix message delay/ordering Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 07/98] mac80211: fix use of uninitialised values in RX aggregation Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 11/98] [media] adv7604: fix tx 5v detect regression Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 20/98] Fix directory hardlinks from deleted directories Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 25/98] fbcon: set a default value to blink interval Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 23/98] libata: Align ata_device's id on a cacheline Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 30/98] ALSA: pcm: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 33/98] ALSA: timer: Fix ioctls for X32 ABI Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 38/98] MIPS: kvm: Fix ioctl error handling. Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 28/98] vfio: fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 17/98] usb: chipidea: otg: change workqueue ci_otg as freezable Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 36/98] Fix cifs_uniqueid_to_ino_t() function for s390x Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100
  [PATCH 4.2.y-ckt 24/98] can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() Kamal Mostafa <kamal@canonical.com> - 2016-03-16 01:00 +0100

csiph-web