]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Input: synaptics-rmi - fix crash with unsupported versions of F34
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Mon, 5 May 2025 22:49:59 +0000 (15:49 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Jun 2025 10:05:18 +0000 (11:05 +0100)
commitf3c2b179b413441300abfab03405ab5362ff2751
treef05de0b028578e07f2b9fdafb3f68294ff959e2d
parent17e5ca8ef81cdb9f042cc7b057355200103711fb
Input: synaptics-rmi - fix crash with unsupported versions of F34

[ Upstream commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 ]

Sysfs interface for updating firmware for RMI devices is available even
when F34 probe fails. The code checks for presence of F34 "container"
pointer and then tries to use the function data attached to the
sub-device. F34 assigns the function data early, before it knows if
probe will succeed, leaving behind a stale pointer.

Fix this by expanding checks to not only test for presence of F34
"container" but also check if there is driver data assigned to the
sub-device, and call dev_set_drvdata() only after we are certain that
probe is successful.

This is not a complete fix, since F34 will be freed during firmware
update, so there is still a race when fetching and accessing this
pointer. This race will be addressed in follow-up changes.

Reported-by: Hanno Böck <hanno@hboeck.de>
Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/input/rmi4/rmi_f34.c