linux-kernel - Re: [PATCH V2] Input: synaptics-rmi4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZtdYJkU17y1iNsLG@google.com>
Date: Tue, 3 Sep 2024 11:40:38 -0700
From: Dmitry Torokhov <dmitry.torokhov@...il.com>
To: Richard Acayan <mailingradian@...il.com>
Cc: Marge Yang <marge.yang@...synaptics.com>, linux-input@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Vincent Huang <Vincent.Huang@...synaptics.com>,
	david.chiu@...synaptics.com, derek.cheng@...synaptics.com,
	sam.tsai@...aptics.com
Subject: Re: [PATCH V2] Input: synaptics-rmi4 - Supports to query DPM value.

On Tue, Sep 03, 2024 at 02:07:23PM -0400, Richard Acayan wrote:
> > +	/* Use the Query DPM feature when the query register exists for resolution. */
> > +	item = rmi_get_register_desc_item(&f12->query_reg_desc, RMI_F12_QUERY_RESOLUTION);
> > +	if (item) {
> > +		offset = rmi_register_desc_calc_reg_offset(&f12->query_reg_desc,
> > +			RMI_F12_QUERY_RESOLUTION);
> > +		query_dpm_addr = fn->fd.query_base_addr	+ offset;
> > +		ret = rmi_read(fn->rmi_dev, query_dpm_addr, buf);
> > +		if (ret < 0) {
> > +			dev_err(&fn->dev, "Failed to read DPM value: %d\n", ret);
> > +			return -ENODEV;
> > +		}
> > +		dpm_resolution = buf[0];
> > +
> > +		sensor->x_mm = sensor->max_x / dpm_resolution;
> > +		sensor->y_mm = sensor->max_y / dpm_resolution;
> > +	} else {
> > +		if (rmi_register_desc_has_subpacket(item, 3)) {
> 
> The item variable is NULL in this branch, as it was overwritten just
> before the if statement.
> 
> This patch causes a NULL pointer dereference:

Ugh, indeed. I guess the simplest way of fixing this would be:

diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index fc2cc8e2b0ba..8246fe77114b 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -129,9 +129,8 @@ static int rmi_f12_read_sensor_tuning(struct f12_data *f12)
 	 * Use the Query DPM feature when the resolution query register
 	 * exists.
 	 */
-	item = rmi_get_register_desc_item(&f12->query_reg_desc,
-					  RMI_F12_QUERY_RESOLUTION);
-	if (item) {
+	if (rmi_get_register_desc_item(&f12->query_reg_desc,
+				       RMI_F12_QUERY_RESOLUTION)) {
 		offset = rmi_register_desc_calc_reg_offset(&f12->query_reg_desc,
 						RMI_F12_QUERY_RESOLUTION);
 		query_dpm_addr = fn->fd.query_base_addr	+ offset;

Could you please tell me if this works for you?

Thanks.

-- 
Dmitry