From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f170.google.com (mail-dy1-f170.google.com [74.125.82.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 29893183CC3 for ; Sat, 23 May 2026 05:06:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779512804; cv=none; b=udrG99msmKRiyM0eB1jehaMuCCWhdZEVcHeEd8p4BBbUGmtWcfKuZJ6n3jsi/UCT/s0MCeY3ZLkgTeGLdl4JpFmIQmv+uz81WCO29OEY/HNnPoG29ARaVhz9xhagOOd5De82QpBejX0rhRMtLgqJeyN8cosT8JYrZaAD4mEUVFw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779512804; c=relaxed/simple; bh=Shgi5jElQdfBIcR6Rb8wt7MvaQ1F9hHKWfstV1Edmk0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AjCeaUm4KFke0i6UUBaCIcZziKmKDVraoZmib7cixftvIGJuYyORaUMfelpRR4g0nv6kCx0ZDg/Hthx5l4qaw9ywDcHrDHzQZh7fX4L/wE2Y9lcsVfHaD7VNOlL2/ERSVOvCN9LWmN1U7F8lvK1tu8QRcZUFSzOsCIl4gFY6crs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KUDmJlwP; arc=none smtp.client-ip=74.125.82.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KUDmJlwP" Received: by mail-dy1-f170.google.com with SMTP id 5a478bee46e88-2f0ad52830cso10363294eec.1 for ; Fri, 22 May 2026 22:06:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779512802; x=1780117602; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=MJRSgIm5PQp/1IbzKWdJwM1Izu6wojlwAOub5x9zwME=; b=KUDmJlwPsq8EcNVP9lNzpO7gjE6BbG2YOQn2Ctf6GZaQJnjlg02LkcHRufCcj1cF5I +wJHX3rOyppG/DRStVmP4R5xAhC6fjdq9FXZlMrN7qRb09lf5UYKIYhe5XMrKSOY9H2S qaemq+L+pEqfjlFzjI11gbtw52aOPCVWlL9o8xctuC179B67Li6s4Au3tfEQDxQUlaMk 96VrcZ+CG0zfkiPFGE6tokzXu8IpCa8t3g6pC2+T3+YVwpw59GL/SF44kqa2LyE6H7Bn gpIId+FebuwU6O09LK1I92NvoaG4hc72YJVPNpfvykR5fU7C8CpNl3NdPX1TIcpasT2I u9lA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779512802; x=1780117602; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=MJRSgIm5PQp/1IbzKWdJwM1Izu6wojlwAOub5x9zwME=; b=a6W/NcRJrVI0GEuXVN51evO1MKjf5pTJ9MeT1Jn9/T3XB87Jk+SENZIMUxGJO9RXat lkMb85RnO1tYYXVbXF1sINpspcweYGymw1J+Oj3UAorMNDB1mIC3VuSUiOvAe0xQwwpz J5HZ/7ZAFXN6UuFGsKT5w1yHiHFd6HEUvaYYhflo8Y/+RKWwV6mdw/RFMsOQSiP/JyOC 9Cwe0f1COslfBifXqlGjayB/QOmffyj3rsyUnWT1O7WEKfQv7fYBB9dyL7U8ksAQDwYA NzsRrkcbDaG/TqkHPOT77uCg8fNQUZ+3orgXphfg9yNDG7mnuxffAjMGhugI6pTmEd4q XdBQ== X-Forwarded-Encrypted: i=1; AFNElJ9tXiKST8gJl6ydWXXOqpeCarBZfmsn6mSvUozdxFPkb+Hem8t3mq/OKL9adA7M0PZ9IA/3TofJl3JBwuM=@vger.kernel.org X-Gm-Message-State: AOJu0YzVrKEsaRjvojjYyH5pLv+pvOZhOUC0BRg/eSxKNxQepo+YuSx/ 4L3JSc5YEriSCo68tbBOOEbAnYUupn4oHqBRZH8RYgEjK3JVfP37MeDC X-Gm-Gg: Acq92OGbxcXGY01sqyja7mHyDE0ZOdubQJ72d2ZbTlFJJ/7Vd7U+jBqxjxJZTA7LVUx 5Bsd9LTeE+smqFOv76HbSDQHp4lErnUDo4Ln4pcmSTbBWfB3tf5OExhEQZsiOQatuQ4m4Fo7ODv OScDeGUt3hTMqWR8xf7hdMzWxJZJf2kwUKjt7Fki7zyr5I5/bx/8wi7fbr3tUvGLAVlu6yX9wQF j+OTRhG38RjwAT/XKOw+mo6zgpGYYEp7xftBRF26oyuvQRAI3ZxvB17F8YuBqewmJvQBUp8Y0TC xLpJljKpPwMSJ2CbjyNYncqG/HSwWTlL6O2kRSUxDetF5tVnyVG1QLb8nBX12L4LwaEb3sNFQ69 tArBfr+DlJL8y5yE37lV/Yhb5ROqXoY9M02KRmlW624WHX4Y0JQH972xllLZ7f/rUoyTURlyQaC QM2rREtlv/9gjTnPqzhKlvYKCSVEwVOdbuNgZuwPU949aqbF8ndQmp75cp2MPpohM6OETwmYFpo 9jmLZLeiHn0KGMI0Fqkgw4i X-Received: by 2002:a05:7301:6704:b0:2e2:d94d:6188 with SMTP id 5a478bee46e88-3044904e1e6mr3083881eec.7.1779512802332; Fri, 22 May 2026 22:06:42 -0700 (PDT) Received: from dtor-ws.sjc.corp.google.com ([2a00:79e0:2ebe:8:7e45:2bd:3c86:d34a]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30451f3feadsm3502583eec.13.2026.05.22.22.06.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 22 May 2026 22:06:41 -0700 (PDT) From: Dmitry Torokhov To: linux-input@vger.kernel.org Cc: Thomas Fourier , Seungjin Bae , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Sashiko bot Subject: [PATCH 03/11] Input: ims-pcu - fix type confusion in CDC union descriptor parsing Date: Fri, 22 May 2026 22:06:21 -0700 Message-ID: <20260523050634.501509-3-dmitry.torokhov@gmail.com> X-Mailer: git-send-email 2.54.0.746.g67dd491aae-goog In-Reply-To: <20260523050634.501509-1-dmitry.torokhov@gmail.com> References: <20260523050634.501509-1-dmitry.torokhov@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to the driver overwriting the private data of another interface. Validate that the control interface found in the descriptor is indeed the one we are probing. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Reported-by: Sashiko bot Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov --- drivers/input/misc/ims-pcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c index d0934d577b5e..a134483e543b 100644 --- a/drivers/input/misc/ims-pcu.c +++ b/drivers/input/misc/ims-pcu.c @@ -1693,7 +1693,7 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev, union_desc->bMasterInterface0); - if (!pcu->ctrl_intf) + if (pcu->ctrl_intf != intf) return -EINVAL; alt = pcu->ctrl_intf->cur_altsetting; -- 2.54.0.746.g67dd491aae-goog