linux-kernel - Re: [PATCH] Input: atmel_mxt_ts - fix NULL pointer dereference in mxt_object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CALEuBakeMdTor9gbshrJmyJ4uuw5W9QC=XBCF26+UAe3FUdENg@mail.gmail.com>
Date: Wed, 21 Jan 2026 16:54:50 +0800
From: 齐柯宇 <qikeyu2017@...il.com>
To: Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc: nick@...anahar.org, rydberg@...omail.se, jy0922.shim@...sung.com, 
	bleung@...omium.org, ezequiel@...guardiasur.com.ar, 
	linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Input: atmel_mxt_ts - fix NULL pointer dereference in mxt_object_show

Hi Dmitry,

Thank you for the review.

You're absolutely right. The NULL check only narrows the race window but
does not eliminate the race condition - the pointers can still be
invalidated between the check and the actual dereference.

I will rework the patch with proper synchronization to fully address this
issue.

regards,

Kery

Dmitry Torokhov <dmitry.torokhov@...il.com> 于2026年1月21日周三 02:22写道：

>
> Hi,
>
> On Thu, Jan 15, 2026 at 03:43:37AM +0800, 齐柯宇 wrote:
> > diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c
> > b/drivers/input/touchscreen/atmel_mxt_ts.c
> > index dd0544cc1bc1..401fcae2264d 100644
> > --- a/drivers/input/touchscreen/atmel_mxt_ts.c
> > +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
> > @@ -2859,6 +2859,10 @@ static ssize_t mxt_object_show(struct device *dev,
> >   int error;
> >   u8 *obuf;
> >
> > + /* Check for NULL to prevent race condition during firmware update */
> > + if (!data->info || !data->object_table)
> > +   return -ENODEV;
> > +
>
> What stops the pointers from being invalidated right here?
>
> >   /* Pre-allocate buffer large enough to hold max sized object. */
> >   obuf = kmalloc(256, GFP_KERNEL);
> >   if (!obuf)
>
> Thanks.
>
> --
> Dmitry