]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Input: synaptics-rmi - fix crash with unsupported versions of F34
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Mon, 5 May 2025 22:49:59 +0000 (15:49 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Jun 2025 10:07:20 +0000 (11:07 +0100)
commit5c73533fd6acf309fd27eca6338aadd4abe66099
tree20b05bc467004f667b85e8d381a1204c48c970f9
parent10fd1856c3dd98c04783af44629fb520896bb30a
Input: synaptics-rmi - fix crash with unsupported versions of F34

[ Upstream commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 ]

Sysfs interface for updating firmware for RMI devices is available even
when F34 probe fails. The code checks for presence of F34 "container"
pointer and then tries to use the function data attached to the
sub-device. F34 assigns the function data early, before it knows if
probe will succeed, leaving behind a stale pointer.

Fix this by expanding checks to not only test for presence of F34
"container" but also check if there is driver data assigned to the
sub-device, and call dev_set_drvdata() only after we are certain that
probe is successful.

This is not a complete fix, since F34 will be freed during firmware
update, so there is still a race when fetching and accessing this
pointer. This race will be addressed in follow-up changes.

Reported-by: Hanno Böck <hanno@hboeck.de>
Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/input/rmi4/rmi_f34.c