Patch "Input: xpad - fix oops when attaching an unknown Xbox One gamepad" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

Input: xpad - fix oops when attaching an unknown Xbox One gamepad

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
input-xpad-fix-oops-when-attaching-an-unknown-xbox-one-gamepad.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Cameron Gutman <[email protected]>
Date: Thu, 23 Jun 2016 10:24:42 -0700
Subject: Input: xpad - fix oops when attaching an unknown Xbox One gamepad

From: Cameron Gutman <[email protected]>

commit c7f1429389ec1aa25e042bb13451385fbb596f8c upstream.

Xbox One controllers have multiple interfaces which all have the same class, subclass, and protocol. One of the these interfaces has only a single endpoint. When Xpad attempts to bind to this interface, it causes an oops when trying initialize the output URB by trying to access the second endpoint's descriptor.

This situation was avoided for known Xbox One devices by checking the XTYPE constant associated with the VID and PID tuple. However, this breaks when new or previously unknown Xbox One controllers are attached to the system.

This change addresses the problem by deriving the XTYPE for Xbox One controllers based on the interface protocol before checking the interface number.

---
 drivers/input/joystick/xpad.c |   23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

@@ -1427,16 +1427,6 @@ static int xpad_probe(struct usb_interfa
 			break;
 	}
 
-	if (xpad_device[i].xtype == XTYPE_XBOXONE &&
-	    intf->cur_altsetting->desc.bInterfaceNumber != 0) {
-		/*
-		 * The Xbox One controller lists three interfaces all with the
-		 * same interface class, subclass and protocol. Differentiate by
-		 * interface number.
-		 */
-		return -ENODEV;
-	}
-
 	xpad = kzalloc(sizeof(struct usb_xpad), GFP_KERNEL);
 	if (!xpad)
 		return -ENOMEM;

@@ -1468,6 +1458,8 @@ static int xpad_probe(struct usb_interfa
 		if (intf->cur_altsetting->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC) {
 			if (intf->cur_altsetting->desc.bInterfaceProtocol == 129)
 				xpad->xtype = XTYPE_XBOX360W;
+			else if (intf->cur_altsetting->desc.bInterfaceProtocol == 208)
+				xpad->xtype = XTYPE_XBOXONE;
 			else
 				xpad->xtype = XTYPE_XBOX360;
 		} else {

@@ -1482,6 +1474,17 @@ static int xpad_probe(struct usb_interfa
 			xpad->mapping |= MAP_STICKS_TO_NULL;
 	}
 
+	if (xpad->xtype == XTYPE_XBOXONE &&
+	    intf->cur_altsetting->desc.bInterfaceNumber != 0) {
+		/*
+		 * The Xbox One controller lists three interfaces all with the
+		 * same interface class, subclass and protocol. Differentiate by
+		 * interface number.
+		 */
+		error = -ENODEV;
+		goto err_free_in_urb;
+	}
+
 	error = xpad_init_output(intf, xpad);
 	if (error)
 		goto err_free_in_urb;

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/input-xpad-validate-usb-endpoint-count-during-probe.patch queue-4.6/input-xpad-fix-oops-when-attaching-an-unknown-xbox-one-gamepad.patch