linux-kernel - [PATCH] Input: atmel_mxt_ts - fix NULL pointer dereference in mxt_object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALEuBan7Knm3G3eXPd8BZ37jVQFtRs7fAssts+picVKHBjGBqQ@mail.gmail.com>
Date: Thu, 15 Jan 2026 03:43:37 +0800
From: 齐柯宇 <qikeyu2017@...il.com>
To: nick@...anahar.org, dmitry.torokhov@...il.com
Cc: rydberg@...omail.se, jy0922.shim@...sung.com, bleung@...omium.org, 
	ezequiel@...guardiasur.com.ar, linux-input@...r.kernel.org, 
	linux-kernel@...r.kernel.org, 齐柯宇 <qikeyu2017@...il.com>
Subject: [PATCH] Input: atmel_mxt_ts - fix NULL pointer dereference in mxt_object_show

This fix was discovered through static code analysis.

In mxt_object_show(), the code directly dereferences data->info and
data->object_table without checking if they are NULL. This can lead to
a NULL pointer dereference kernel crash when the sysfs file is accessed
during firmware update or device removal.

[Call Chain Analysis]
The vulnerable sysfs handler is exposed through the following registration:

  Driver registration:
    mxt_driver.driver.dev_groups = mxt_groups
      -> mxt_attrs[] contains:
         - dev_attr_object.attr     -> mxt_object_show()     [VULNERABLE]
         - dev_attr_update_fw.attr  -> mxt_update_fw_store()
                                                           [TRIGGERS FREE]

  Initialization path:
    mxt_probe()
      -> mxt_initialize()
        -> mxt_read_info_block()
          -> data->info = (struct mxt_info *)id_buf        [line 1918]
          -> data->object_table = (struct mxt_object *)... [line 1934]

  Resource release path (called during firmware update or device removal):
    mxt_update_fw_store() OR mxt_remove()
      -> mxt_free_object_table()
        -> data->object_table = NULL  [line 1713]
        -> data->info = NULL          [line 1714]

[Data Flow Analysis]
The critical data flow is:

  data->info:
    - Allocated and set in mxt_read_info_block() from id_buf
    - Released and set to NULL in mxt_free_object_table()
    - Accessed in mxt_object_show() at line 2868: data->info->object_num

  data->object_table:
    - Set in mxt_read_info_block() as pointer into id_buf
    - Set to NULL in mxt_free_object_table()
    - Accessed in mxt_object_show() at line 2869: data->object_table + i

[Race Condition Scenario]
The vulnerability can be triggered by the following race condition:

  Thread A (reading sysfs)           Thread B (firmware update)
  --------------------------         --------------------------
  T1: open /sys/.../object
  T2: mxt_object_show()
  T3: data = dev_get_drvdata(dev)
  T4: obuf = kmalloc(...)
                                     T5: echo fw > /sys/.../update_fw
                                     T6: mxt_update_fw_store()
                                     T7: mxt_free_object_table()
                                     T8: data->info = NULL
  T9: for (i < data->info->object_num)
      -> NULL pointer dereference!

[User-Triggerable Paths]
Users can trigger this vulnerability through:

  1. Firmware update race condition (requires root):
     Terminal A: # cat /sys/bus/i2c/devices/<dev>/object
     Terminal B: # echo firmware.bin > /sys/bus/i2c/devices/<dev>/update_fw

  2. Device unbind race condition (requires root):
     Terminal A: # cat /sys/bus/i2c/devices/<dev>/object
     Terminal B: # echo "<dev>" > /sys/bus/i2c/drivers/atmel_mxt_ts/unbind

  3. Physical device removal:
     Reading sysfs while physically removing the touchscreen device

How to fix:
Add NULL checks for data->info and data->object_table at the beginning
of mxt_object_show() to prevent NULL pointer dereference when these
resources are freed during concurrent firmware update or device removal.

Fixes: 4cf51c383d7a ("Input: Add ATMEL QT602240 touchscreen driver")
Fixes: 068bdb67ef74 ("Input: atmel_mxt_ts - fix the firmware update")
Signed-off-by: Kery Qi <qikeyu2017@...il.com>
---
 drivers/input/touchscreen/atmel_mxt_ts.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c
b/drivers/input/touchscreen/atmel_mxt_ts.c
index dd0544cc1bc1..401fcae2264d 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -2859,6 +2859,10 @@ static ssize_t mxt_object_show(struct device *dev,
  int error;
  u8 *obuf;

+ /* Check for NULL to prevent race condition during firmware update */
+ if (!data->info || !data->object_table)
+   return -ENODEV;
+
  /* Pre-allocate buffer large enough to hold max sized object. */
  obuf = kmalloc(256, GFP_KERNEL);
  if (!obuf)
-- 
2.34.1