Received-SPF: pass (google.com: domain of linux-kernel+bounces-91731-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Message-ID: <1c13f4f7-fa02-4864-8621-bfd738546fc2@leemhuis.info>
Date: Tue, 5 Mar 2024 07:20:16 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] Revert "Input: bcm5974 - check endpoint type before
 starting traffic"
Content-Language: en-US, de-DE
To: Javier Carrasco <javier.carrasco.cruz@gmail.com>,
 Henrik Rydberg <rydberg@bitmath.org>,
 Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org,
 regressions@lists.linux.dev
References: <20240305-revert_bcm5974_ep_check-v1-1-db4f0422588f@gmail.com>
From: "Linux regression tracking (Thorsten Leemhuis)"
 <regressions@leemhuis.info>
Reply-To: Linux regressions mailing list <regressions@lists.linux.dev>
In-Reply-To: <20240305-revert_bcm5974_ep_check-v1-1-db4f0422588f@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 05.03.24 06:52, Javier Carrasco wrote:
> This patch intended to fix an well-knonw issue in old drivers where the
> endpoint type is taken for granted, which is often triggered by fuzzers.
> 
> That was the case for this driver [1], and although the fix seems to be
> correct, it uncovered another issue that leads to a regression [2] if
> the endpoints of the current interface are checked. The driver makes use
> of endpoints that belong to a different interface rather than the one it
> binds (it binds to the third interface, but also accesses an endpoint
> from a different one). The driver should claim the interfaces it
> requires, but that is still not the case.
> 
> Given that the regression is more severe than the issue found by
> syzkaller, the best approach is reverting the patch that causes the
> regression, and trying to fix the underlying problem before checking
> the endpoint types again.
> 
> Note that reverting this patch will probably trigger the syzkaller bug
> at some point.
>> [1] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622
> [2] https://lore.kernel.org/linux-input/ab9d758c-3ce9-42f6-99af-877055a589e6@leemhuis.info/T/#t

FWIW, these should be Link: or Closes tags, as explained in the docs.
And there is a better lore link. And there is the bugzilla entry as well.
Hence...
 
> This reverts commit 2b9c3eb32a699acdd4784d6b93743271b4970899.
> 
> Fixes: b516b1b0dfcc ("Revert "Input: bcm5974 - check endpoint type before starting traffic"")

you might want to add them here like this:

 Link: https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 [1]
 Link: https://lore.kernel.org/linux-input/87sf161jjc.wl-tiwai@suse.de/ [2]
 Link: https://bugzilla.suse.com/show_bug.cgi?id=1220030

In an ideal world we also would add a "Reported-by: Jacopo Radice" before
the bugzilla line, as the details in the suse bugtracker apparently is
public, but it's likely better to not go down that path.

> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>

Ciao, Thorsten