linux/drivers/input/misc
Dmitry Torokhov ca459e237b Input: ims-pcu - fix type confusion in CDC union descriptor parsing
The driver currently trusts the bMasterInterface0 from the CDC union
descriptor without verifying that it matches the interface being
probed. This could lead to the driver overwriting the private data of
another interface.

Validate that the control interface found in the descriptor is indeed
the one we are probing.

Fixes: 628329d524 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
History 2026-06-06 21:03:34 -07:00
..
88pm80x_onkey.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
88pm860x_onkey.c Input: 88pm860x - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() 2023-01-09 20:25:20 -08:00
88pm886-onkey.c input: Add onkey driver for Marvell 88PM886 PMIC 2024-06-28 15:41:20 +01:00
ab8500-ponkey.c Input: ab8500-ponkey - fix incorrect name in 'ab8500_ponkey' doc header 2020-11-08 22:27:54 -08:00
ad714x-i2c.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
ad714x-spi.c Input: ad714x - unify dev_pm_ops using EXPORT_SIMPLE_DEV_PM_OPS() 2023-01-27 14:49:52 -08:00
ad714x.c Input: include export.h in modules using EXPORT_SYMBOL*() 2025-08-21 12:00:59 -07:00
ad714x.h Input: ad714x - unify dev_pm_ops using EXPORT_SIMPLE_DEV_PM_OPS() 2023-01-27 14:49:52 -08:00
adxl34x-i2c.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
adxl34x-spi.c Input: adxl34x - switch to using managed resources 2024-06-11 11:17:44 -07:00
adxl34x.c Input: include export.h in modules using EXPORT_SYMBOL*() 2025-08-21 12:00:59 -07:00
adxl34x.h Input: adxl34x - switch to using managed resources 2024-06-11 11:17:44 -07:00
apanel.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
ariel-pwrbutton.c Input: ariel-pwrbutton - add SPI device ID table 2021-10-01 21:24:14 -07:00
arizona-haptics.c ASoC: arizona-haptics: convert to snd_soc_dapm_xxx() 2025-11-17 00:14:19 +00:00
atc260x-onkey.c input: atc260x: Add onkey driver for ATC260x PMICs 2021-03-10 11:10:30 +00:00
ati_remote2.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
atlas_btns.c Input: atlas_btns - modernize the driver 2026-06-06 14:05:30 -07:00
atmel_captouch.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
aw86927.c Input: aw86927 - add support for Awinic AW86938 2026-04-01 09:08:33 -07:00
axp20x-pek.c Input: axp20x-pek - avoid needless newline removal 2023-09-30 09:35:31 -07:00
bma150.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
cm109.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cma3000_d0x.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cma3000_d0x.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234 2019-06-19 17:09:07 +02:00
cma3000_d0x_i2c.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
cobalt_btns.c Input: cobalt_btns - switch to using polled mode of input devices 2019-10-29 17:14:17 -07:00
cpcap-pwrbutton.c Input: cpcap-pwrbutton - replace GPLv2 boilerplate with SPDX 2023-07-05 14:50:00 -07:00
cs40l50-vibra.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
da7280.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
da9052_onkey.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
da9055_onkey.c Input: switch back to struct platform_driver::remove() 2024-10-15 11:43:25 -07:00
da9063_onkey.c Input: da9063_onkey - avoid explicitly setting input's parent 2024-01-04 12:02:20 -08:00
drv260x.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
drv2665.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
drv2667.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
e3x0-button.c Input: e3x0-button - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() 2023-01-09 20:25:21 -08:00
gpio-beeper.c Input: Fully open-code compatible for grepping 2025-06-17 14:12:32 -07:00
gpio-vibra.c Input: Explicitly include correct DT includes 2023-07-17 10:03:07 -07:00
gpio_decoder.c Input: gpio_decoder - don't use "proxy" headers 2026-01-21 12:22:43 -08:00
hisi_powerkey.c Input: hisi_powerkey - enable system-wakeup for s2idle 2025-05-10 22:26:33 -07:00
hp_sdc_rtc.c Input: hp_sdc_rtc - mark an unused function as __maybe_unused 2023-02-21 13:57:40 -08:00
ibm-panel.c Input: ibm-panel - use guard notation when acquiring spinlock 2024-10-03 09:10:36 -07:00
ideapad_slidebar.c Input: i8042 - Add support for platform filter contexts 2025-01-15 16:26:39 +02:00
ims-pcu.c Input: ims-pcu - fix type confusion in CDC union descriptor parsing 2026-06-06 21:03:34 -07:00
iqs269a.c Input: iqs269a - use cleanup facility for fwnodes 2024-10-03 09:10:37 -07:00
iqs626a.c Input: iqs626a - replace snprintf() with scnprintf() 2025-06-03 21:39:35 -07:00
iqs7222.c Input: iqs7222 - avoid enabling unused interrupts 2025-09-04 05:26:09 -07:00
Kconfig Input: pcap_keys - remove unused driver 2026-04-30 21:32:50 -07:00
keyspan_remote.c Input: keyspan-remote - refactor endpoint lookup 2026-03-30 16:54:41 -07:00
kxtj9.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
m68kspkr.c Input: switch back to struct platform_driver::remove() 2024-10-15 11:43:25 -07:00
Makefile Input: pcap_keys - remove unused driver 2026-04-30 21:32:50 -07:00
max7360-rotary.c input: misc: Add support for MAX7360 rotary 2025-09-16 15:24:48 +01:00
max8925_onkey.c Input: max8925_onkey - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() 2023-01-09 20:25:21 -08:00
max8997_haptic.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
max77650-onkey.c Input: max77650-onkey - add of_match table 2020-01-16 20:23:24 -08:00
max77693-haptic.c Input: max77693 - convert to atomic pwm operation 2025-08-03 23:12:09 -07:00
mc13783-pwrbutton.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mma8450.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
nxp-bbnsm-pwrkey.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
palmas-pwrbutton.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pcf8574_keypad.c Input: Use named initializers for arrays of i2c_device_data 2026-05-30 22:10:47 -07:00
pcspkr.c Input: switch back to struct platform_driver::remove() 2024-10-15 11:43:25 -07:00
pf1550-onkey.c Input: pf1550 - remove "defined but unused" warning 2025-12-13 01:34:39 -08:00
pm8xxx-vibrator.c input: pm8xxx-vibrator: add new SPMI vibrator support 2024-04-17 15:27:12 -07:00
pm8941-pwrkey.c Input: pm8941-pwrkey - disable wakeup for resin by default 2025-09-24 22:43:07 -07:00
pmic8xxx-pwrkey.c Input: Explicitly include correct DT includes 2023-07-17 10:03:07 -07:00
powermate.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pwm-beeper.c Input: pwm-beeper - use guard notation when acquiring spinlock 2024-10-03 09:10:37 -07:00
pwm-vibra.c pwm: Rename pwm_apply_state() to pwm_apply_might_sleep() 2023-12-20 16:07:04 +01:00
qnap-mcu-input.c Input: qnap-mcu-input - omit error message when memory allocation fails 2025-10-17 21:42:03 -07:00
rave-sp-pwrbutton.c Input: add RAVE SP Powerbutton driver 2018-03-08 15:34:45 -08:00
rb532_button.c MIPS/input: Move RB532 button to GPIO descriptors 2026-04-13 15:41:56 +02:00
regulator-haptic.c Input: Use str_enable_disable-like helpers 2025-01-14 13:41:41 -08:00
retu-pwrbutton.c Input: misc - drop empty remove functions 2017-01-21 23:53:34 -08:00
rk805-pwrkey.c Input: rk805-pwrkey - fix module autoloading 2022-08-22 16:59:49 -07:00
rotary_encoder.c Input: rotary_encoder - use guard notation when acquiring mutex 2024-10-03 09:10:38 -07:00
rt5120-pwrkey.c Input: rt5120 - add power key support 2022-08-31 15:48:49 -07:00
sc27xx-vibra.c Input: sc27xx - add support for sc2730 and sc2721 2020-12-11 19:00:21 -08:00
sgi_btns.c Input: add missing MODULE_DESCRIPTION() macros 2024-06-09 14:38:48 -07:00
soc_button_array.c Input: switch back to struct platform_driver::remove() 2024-10-15 11:43:25 -07:00
sparcspkr.c Input: sparcspkr - avoid unannotated fall-through 2025-04-18 18:38:46 -07:00
stpmic1_onkey.c Input: stpmic1_onekey - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() 2023-01-09 20:25:23 -08:00
tps6594-pwrbutton.c input: tps6594-pwrbutton: Add power button functionality 2025-09-03 11:28:07 +01:00
tps65218-pwrbutton.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_320.RULE 2022-06-10 14:51:36 +02:00
tps65219-pwrbutton.c Input: switch back to struct platform_driver::remove() 2024-10-15 11:43:25 -07:00
twl4030-pwrbutton.c Input: twl4030 - fix warnings without CONFIG_OF 2026-01-07 21:54:29 -08:00
twl4030-vibra.c Input: twl4030-vibra - use cleanup facility for device_node 2024-10-19 21:21:40 -07:00
twl6040-vibra.c Input: twl6040-vibra - use cleanup facility for device_node 2024-10-19 21:21:39 -07:00
uinput.c Merge branch 'next' into for-linus 2026-04-19 18:28:57 -07:00
wistron_btns.c Input updates for v6.13-rc0 2024-11-25 10:31:39 -08:00
wm831x-on.c Input: switch back to struct platform_driver::remove() 2024-10-15 11:43:25 -07:00
xen-kbdfront.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
yealink.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
yealink.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00