Commit 9eced77f authored by Rahul Rameshbabu's avatar Rahul Rameshbabu Committed by sanglipeng
Browse files

HID: multitouch: Correct devm device reference for hidinput input_dev name 

stable inclusion
from stable-v5.10.195
commit 15ec7cb55e7d88755aa01d44a7a1015a42bfce86
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I95JOC

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=15ec7cb55e7d88755aa01d44a7a1015a42bfce86



--------------------------------

[ Upstream commit 47943946 ]

Reference the HID device rather than the input device for the devm
allocation of the input_dev name. Referencing the input_dev would lead to a
use-after-free when the input_dev was unregistered and subsequently fires a
uevent that depends on the name. At the point of firing the uevent, the
name would be freed by devres management.

Use devm_kasprintf to simplify the logic for allocating memory and
formatting the input_dev name string.

Reported-by: default avatarMaxime Ripard <mripard@kernel.org>
Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae


Fixes: c08d46aa ("HID: multitouch: devm conversion")
Suggested-by: default avatarMaxime Ripard <mripard@kernel.org>
Suggested-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: default avatarRahul Rameshbabu <sergeantsagara@protonmail.com>
Reviewed-by: default avatarMaxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20230824061308.222021-3-sergeantsagara@protonmail.com


Signed-off-by: default avatarBenjamin Tissoires <bentiss@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent 36b4a124

drivers/hid/hid-multitouch.c

+3 −10
Original line number Diff line number Diff line
@@ -1541,7 +1541,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app) 
static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)

{

	struct mt_device *td = hid_get_drvdata(hdev);

	char *name;

	const char *suffix = NULL;

	struct mt_report_data *rdata;

	struct mt_application *mt_application = NULL;
@@ -1595,15 +1594,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) 
		break;

	}



	if (suffix) {

		name = devm_kzalloc(&hi->input->dev,

				    strlen(hdev->name) + strlen(suffix) + 2,

				    GFP_KERNEL);

		if (name) {

			sprintf(name, "%s %s", hdev->name, suffix);

			hi->input->name = name;

		}

	}

	if (suffix)

		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,

						 "%s %s", hdev->name, suffix);



	return 0;

}