In the pegasus_notetaker driver, the pegasus_probe() function allocates
the URB transfer buffer using the wMaxPacketSize value from
the endpoint descriptor. An attacker can use a malicious USB descriptor
to force the allocation of a very small buffer.

Subsequently, if the device sends an interrupt packet with a specific
pattern (e.g., where the first byte is 0x80 or 0x42),
the pegasus_parse_packet() function parses the packet without checking
the allocated buffer size. This leads to an out-of-bounds memory access.

Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull input updates from Dmitry Torokhov:

 - support for NT36672A touchscreen added to novatek-nvt-ts driver

 - a change to ads7846 driver to prevent XPT2046 from locking up

 - a change switching platform input dirves back to using remove()
   method (from remove_new())

 - updates to a number of input drivers to use the new cleanup
   facilities (__free(...), guard(), and scoped-guard()) which ensure
   that the resources and locks are released properly and automatically

 - other assorted driver cleanups and fixes.

* tag 'input-for-v6.13-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (109 commits)
  Input: mpr121 - use devm_regulator_get_enable_read_voltage()
  Input: sun4i-lradc-keys - don't include 'pm_wakeup.h' directly
  Input: spear-keyboard - don't include 'pm_wakeup.h' directly
  Input: cypress-sf - constify struct i2c_device_id
  Input: ads7846 - increase xfer array size in 'struct ser_req'
  Input: fix the input_event struct documentation
  Input: i8042 - fix typo dublicate to duplicate
  Input: ads7846 - add dummy command register clearing cycle
  Input: cs40l50 - fix wrong usage of INIT_WORK()
  Input: introduce notion of passive observers for input handlers
  Input: maple_keyb - use guard notation when acquiring mutex
  Input: locomokbd - use guard notation when acquiring spinlock
  Input: hilkbd - use guard notation when acquiring spinlock
  Input: synaptics-rmi4 - switch to using cleanup functions in F34
  Input: synaptics - fix a typo
  dt-bindings: input: rotary-encoder: Fix "rotary-encoder,rollover" type
  Input: omap-keypad - use guard notation when acquiring mutex
  Input: imagis - fix warning regarding 'imagis_3038_data' being unused
  Input: userio - remove unneeded semicolon
  Input: sparcspkr - use cleanup facility for device_node
  ...

Using guard notation makes the code more compact and error handling
more robust by ensuring that mutexes are released in all code paths
when control leaves critical section.

Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://lore.kernel.org/r/ZtjKJsArLu3byTU6@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

asm/unaligned.h is always an include of asm-generic/unaligned.h;
might as well move that thing to linux/unaligned.h and include
that - there's nothing arch-specific in that header.

auto-generated by the following:

for i in `git grep -l -w asm/unaligned.h`; do
	sed -i -e "s/asm\/unaligned.h/linux\/unaligned.h/" $i
done
for i in `git grep -l -w asm-generic/unaligned.h`; do
	sed -i -e "s/asm-generic\/unaligned.h/linux\/unaligned.h/" $i
done
git mv include/asm-generic/unaligned.h include/linux/unaligned.h
git mv tools/include/asm-generic/unaligned.h tools/include/linux/unaligned.h
sed -i -e "/unaligned.h/d" include/asm-generic/Kbuild
sed -i -e "s/__ASM_GENERIC/__LINUX/" include/linux/unaligned.h tools/include/linux/unaligned.h

It is preferred to use sizeof(*pointer) instead of sizeof(type)
due to the type of the variable can change and one needs not
change the former (unlike the latter). This patch has no effect
on runtime behavior.

Signed-off-by: Erick Archer <erick.archer@outlook.com>
Link: https://lore.kernel.org/r/AS8PR02MB7237B05083487507CFAF96B08BFE2@AS8PR02MB7237.eurprd02.prod.outlook.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fix WARNING in pegasus_open/usb_submit_urb
Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13

Warning raised because pegasus_driver submits transfer request for
bogus URB (pipe type does not match endpoint type). Add sanity check at
probe time for pipe value extracted from endpoint descriptor. Probe
will fail if sanity check fails.

Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com
Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Commit 1a59d1b8e05e ("treewide: Replace GPLv2 boilerplate/reference with
SPDX - rule 156") has left some empty comment blocks.

Remove them to save a few lines of code.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/26a2b905b259bfffaf2de5b26f2007b8606970ed.1664478665.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The driver core now has the ability to handle the creation and removal
of device-specific sysfs files, let's use it instead of registering and
unregistering attributes by hand.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20220903051119.1332808-3-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Follow the advice of the below link and prefer 'strscpy' in this
subsystem. Conversion is 1:1 because the return value is not used.
Generated by a coccinelle script.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20220818210022.6865-1-wsa+renesas@sang-engineering.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the "big" set of USB and Thunderbolt driver changes for
  5.18-rc1. For the most part it's been a quiet development cycle for
  the USB core, but there are the usual "hot spots" of development
  activity.

  Included in here are:

   - Thunderbolt driver updates:
       - fixes for devices without displayport adapters
       - lane bonding support and improvements
       - other minor changes based on device testing

   - dwc3 gadget driver changes.

     It seems this driver will never be finished given that the IP core
     is showing up in zillions of new devices and each implementation
     decides to do something different with it...

   - uvc gadget driver updates as more devices start to use and rely on
     this hardware as well

   - usb_maxpacket() api changes to remove an unneeded and unused
     parameter.

   - usb-serial driver device id updates and small cleanups

   - typec cleanups and fixes based on device testing

   - device tree updates for usb properties

   - lots of other small fixes and driver updates.

  All of these have been in linux-next for weeks with no reported
  problems"

* tag 'usb-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (154 commits)
  USB: new quirk for Dell Gen 2 devices
  usb: dwc3: core: Add error log when core soft reset failed
  usb: dwc3: gadget: Move null pinter check to proper place
  usb: hub: Simplify error and success path in port_over_current_notify
  usb: cdns3: allocate TX FIFO size according to composite EP number
  usb: dwc3: Fix ep0 handling when getting reset while doing control transfer
  usb: Probe EHCI, OHCI controllers asynchronously
  usb: isp1760: Fix out-of-bounds array access
  xhci: Don't defer primary roothub registration if there is only one roothub
  USB: serial: option: add Quectel BG95 modem
  USB: serial: pl2303: fix type detection for odd device
  xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI
  xhci: Remove quirk for over 10 year old evaluation hardware
  xhci: prevent U2 link power state if Intel tier policy prevented U1
  xhci: use generic command timer for stop endpoint commands.
  usb: host: xhci-plat: omit shared hcd if either root hub has no ports
  usb: host: xhci-plat: prepare operation w/o shared hcd
  usb: host: xhci-plat: create shared hcd after having added main hcd
  xhci: prepare for operation w/o shared hcd
  xhci: factor out parts of xhci_gen_setup()
  ...