[PATCH] Input: elants_i2c - Fix NULL dereference at probing

[PATCH] Input: elants_i2c - Fix NULL dereference at probing

[Takashi Iwai]

The recent change in elants_i2c driver to support more chips
introduced a regression leading to Oops at probing.  The driver reads
id->driver_data, but the id may be NULL depending on the device type
the driver gets bound.

Add a NULL check and falls back to the default EKTH3500.

Fixes: 9517b95bdc46 ("Input: elants_i2c - add support for eKTF3624")
BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1186454
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 drivers/input/touchscreen/elants_i2c.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c
index 17540bdb1eaf..172a6951cead 100644
--- a/drivers/input/touchscreen/elants_i2c.c
+++ b/drivers/input/touchscreen/elants_i2c.c
@@ -1396,7 +1396,10 @@ static int elants_i2c_probe(struct i2c_client *client,
 	init_completion(&ts->cmd_done);
 
 	ts->client = client;
-	ts->chip_id = (enum elants_chip_id)id->driver_data;
+	if (id)
+		ts->chip_id = (enum elants_chip_id)id->driver_data;
+	else
+		ts->chip_id = EKTH3500;
 	i2c_set_clientdata(client, ts);
 
 	ts->vcc33 = devm_regulator_get(&client->dev, "vcc33");
-- 
2.26.2

Re: [PATCH] Input: elants_i2c - Fix NULL dereference at probing

[Dmitry Torokhov]

Hi Takashi,

On Wed, May 26, 2021 at 09:43:01PM +0200, Takashi Iwai wrote:
> The recent change in elants_i2c driver to support more chips
> introduced a regression leading to Oops at probing.  The driver reads
> id->driver_data, but the id may be NULL depending on the device type
> the driver gets bound.
> 
> Add a NULL check and falls back to the default EKTH3500.

Thank you for the patch. I think my preference would be to switch to
device_get_match_data() and annotate the rest of the match tables with
proper controller types.

Thanks!

-- 
Dmitry

Re: [PATCH] Input: elants_i2c - Fix NULL dereference at probing

[Dmitry Osipenko]

Hello all,

26.05.2021 23:19, Dmitry Torokhov пишет:
> Hi Takashi,
> 
> On Wed, May 26, 2021 at 09:43:01PM +0200, Takashi Iwai wrote:
>> The recent change in elants_i2c driver to support more chips
>> introduced a regression leading to Oops at probing.  The driver reads
>> id->driver_data, but the id may be NULL depending on the device type
>> the driver gets bound.
>>
>> Add a NULL check and falls back to the default EKTH3500.
> 
> Thank you for the patch. I think my preference would be to switch to
> device_get_match_data() and annotate the rest of the match tables with
> proper controller types.

Doesn't a NULL mean that elants_i2c_id[] table fails to match the ACPI
device name? What is the name then?

This could be two patches:
  1 - trivial fix that can be backported easily
  2 - switch to device_get_match_data()

Re: [PATCH] Input: elants_i2c - Fix NULL dereference at probing

[Takashi Iwai]

On Wed, 26 May 2021 22:19:51 +0200,
Dmitry Torokhov wrote:
> 
> Hi Takashi,
> 
> On Wed, May 26, 2021 at 09:43:01PM +0200, Takashi Iwai wrote:
> > The recent change in elants_i2c driver to support more chips
> > introduced a regression leading to Oops at probing.  The driver reads
> > id->driver_data, but the id may be NULL depending on the device type
> > the driver gets bound.
> > 
> > Add a NULL check and falls back to the default EKTH3500.
> 
> Thank you for the patch. I think my preference would be to switch to
> device_get_match_data() and annotate the rest of the match tables with
> proper controller types.

OK, that sounds feasible.  Shall I submit a revised patch?


Takashi

Re: [PATCH] Input: elants_i2c - Fix NULL dereference at probing

[Takashi Iwai]

On Wed, 26 May 2021 22:44:59 +0200,
Dmitry Osipenko wrote:
> 
> Hello all,
> 
> 26.05.2021 23:19, Dmitry Torokhov пишет:
> > Hi Takashi,
> > 
> > On Wed, May 26, 2021 at 09:43:01PM +0200, Takashi Iwai wrote:
> >> The recent change in elants_i2c driver to support more chips
> >> introduced a regression leading to Oops at probing.  The driver reads
> >> id->driver_data, but the id may be NULL depending on the device type
> >> the driver gets bound.
> >>
> >> Add a NULL check and falls back to the default EKTH3500.
> > 
> > Thank you for the patch. I think my preference would be to switch to
> > device_get_match_data() and annotate the rest of the match tables with
> > proper controller types.
> 
> Doesn't a NULL mean that elants_i2c_id[] table fails to match the ACPI
> device name? What is the name then?

I don't own the device, so we need to ask on (open)SUSE Bugzilla.

> This could be two patches:
>   1 - trivial fix that can be backported easily
>   2 - switch to device_get_match_data()

I guess 2 is easy enough to backport to 5.12.x.  Let's see.


thanks,

Takashi

Re: [PATCH] Input: elants_i2c - Fix NULL dereference at probing

[Dmitry Osipenko]

27.05.2021 09:22, Takashi Iwai пишет:
> On Wed, 26 May 2021 22:44:59 +0200,
> Dmitry Osipenko wrote:
>>
>> Hello all,
>>
>> 26.05.2021 23:19, Dmitry Torokhov пишет:
>>> Hi Takashi,
>>>
>>> On Wed, May 26, 2021 at 09:43:01PM +0200, Takashi Iwai wrote:
>>>> The recent change in elants_i2c driver to support more chips
>>>> introduced a regression leading to Oops at probing.  The driver reads
>>>> id->driver_data, but the id may be NULL depending on the device type
>>>> the driver gets bound.
>>>>
>>>> Add a NULL check and falls back to the default EKTH3500.
>>>
>>> Thank you for the patch. I think my preference would be to switch to
>>> device_get_match_data() and annotate the rest of the match tables with
>>> proper controller types.
>>
>> Doesn't a NULL mean that elants_i2c_id[] table fails to match the ACPI
>> device name? What is the name then?
> 
> I don't own the device, so we need to ask on (open)SUSE Bugzilla.

If we will know the name, then alternative fix could be to add the name
to the elants_i2c_id[]. To be honest, I thought that the ID should be
borrowed from elants_acpi_id[] for the ACPI devices, but this was a mistake.

>> This could be two patches:
>>   1 - trivial fix that can be backported easily
>>   2 - switch to device_get_match_data()
> 
> I guess 2 is easy enough to backport to 5.12.x.  Let's see.

Okay