mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2024-11-22 04:38:03 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Input: goodix - fix race on driver unbind

Browse Source 
Because there is no way to detect if the touchscreen has pen support,
the driver is allocating and registering the input_pen input_dev on
receiving the first pen event.

But this means that the input_dev gets allocated after the request_irq()
call which means that the devm framework will free it before disabling
the irq, leaving a window where the irq handler may run and reference the
free-ed input_dev.

To fix this move the allocation of the input_pen input_dev to before
the request_irq() call, while still only registering it on the first pen
event so that the driver does not advertise pen capability on touchscreens
without it (most goodix touchscreens do not have pen support).

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20220131143539.109142-4-hdegoede@redhat.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
Hans de Goede 2022-02-28 22:59:34 -08:00 committed by Dmitry Torokhov
parent ae8e80c5f1
commit 65de58c2a5
2 changed files with 23 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
drivers/input/touchscreen/goodix.c
View File

@ -297,14 +297,14 @@ static int goodix_ts_read_input_report(struct goodix_ts_data *ts, u8 *data)
return -ENOMSG;
}
static struct input_dev *goodix_create_pen_input(struct goodix_ts_data *ts)
static int goodix_create_pen_input(struct goodix_ts_data *ts)
{
struct device *dev = &ts->client->dev;
struct input_dev *input;
input = devm_input_allocate_device(dev);
if (!input)
return NULL;
return -ENOMEM;
input_copy_abs(input, ABS_X, ts->input_dev, ABS_MT_POSITION_X);
input_copy_abs(input, ABS_Y, ts->input_dev, ABS_MT_POSITION_Y);
@ -331,25 +331,23 @@ static struct input_dev *goodix_create_pen_input(struct goodix_ts_data *ts)
input->id.product = 0x1001;
input->id.version = ts->version;
if (input_register_device(input) != 0) {
input_free_device(input);
return NULL;
}
return input;
ts->input_pen = input;
return 0;
}
static void goodix_ts_report_pen_down(struct goodix_ts_data *ts, u8 *data)
{
int input_x, input_y, input_w;
int input_x, input_y, input_w, error;
u8 key_value;
if (!ts->input_pen) {
ts->input_pen = goodix_create_pen_input(ts);
if (!ts->input_pen)
return;
if (!ts->pen_input_registered) {
error = input_register_device(ts->input_pen);
ts->pen_input_registered = (error == 0) ? 1 : error;
}
if (ts->pen_input_registered < 0)
return;
if (ts->contact_size == 9) {
input_x = get_unaligned_le16(&data[4]);
input_y = get_unaligned_le16(&data[6]);
@ -1207,6 +1205,17 @@ static int goodix_configure_dev(struct goodix_ts_data *ts)
return error;
}
/*
* Create the input_pen device before goodix_request_irq() calls
* devm_request_threaded_irq() so that the devm framework frees
* it after disabling the irq.
* Unfortunately there is no way to detect if the touchscreen has pen
* support, so registering the dev is delayed till the first pen event.
*/
error = goodix_create_pen_input(ts);
if (error)
return error;
ts->irq_flags = goodix_irq_flags[ts->int_trigger_type] | IRQF_ONESHOT;
error = goodix_request_irq(ts);
if (error) {

1
drivers/input/touchscreen/goodix.h
View File

@ -94,6 +94,7 @@ struct goodix_ts_data {
u16 version;
bool reset_controller_at_probe;
bool load_cfg_from_disk;
int pen_input_registered;
struct completion firmware_loading_complete;
unsigned long irq_flags;
enum goodix_irq_pin_access_method irq_pin_access_method;