github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-03 03:53:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

platform/x86: thinkpad_acpi: Fix NULL pointer dereferences while probing

Browse Source 
Some subdrivers make use of the global reference tpacpi_pdev during
initialization, which is called from the platform driver's probe.
However, after the commit 38b9ab80db ("platform/x86: thinkpad_acpi:
Move subdriver initialization to tpacpi_pdriver's probe.") this
variable is only properly initialized *after* probing and this can
result in a NULL pointer dereference.

In order to fix this without reverting the commit, register the platform
bundle in two steps, first create and initialize tpacpi_pdev, then
register the driver synchronously with platform_driver_probe(). This way
the benefits of commit 38b9ab80db are preserved.

Additionally, the commit 43fc63a1e8 ("platform/x86: thinkpad_acpi:
Move HWMON initialization to tpacpi_hwmon_pdriver's probe") introduced
a similar problem, however tpacpi_sensors_pdev is only used once inside
the probe, so replace the global reference with the one given by the
probe.

Reported-by: Damian Tometzki <damian@riscv-rocks.de>
Closes: https://lore.kernel.org/r/CAL=B37kdL1orSQZD2A3skDOevRXBzF__cJJgY_GFh9LZO3FMsw@mail.gmail.com/
Fixes: 38b9ab80db ("platform/x86: thinkpad_acpi: Move subdriver initialization to tpacpi_pdriver's probe.")
Fixes: 43fc63a1e8 ("platform/x86: thinkpad_acpi: Move HWMON initialization to tpacpi_hwmon_pdriver's probe")
Tested-by: Damian Tometzki <damian@riscv-rocks.de>
Tested-by: Gene C <arch@sapience.com>
Signed-off-by: Kurt Borja <kuurtb@gmail.com>
Link: https://lore.kernel.org/r/20250330-thinkpad-fix-v1-1-4906b3fe6b74@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
This commit is contained in:
Kurt Borja 2025-03-30 12:39:16 -03:00 committed by Ilpo Järvinen
parent 08733088b5
commit 7b98c1c8e2
No known key found for this signature in database
GPG Key ID: 59AC4F6153E5CE31
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/platform/x86/thinkpad_acpi.c
View File

@ -367,6 +367,7 @@ static struct {
u32 beep_needs_two_args:1;
u32 mixer_no_level_control:1;
u32 battery_force_primary:1;
u32 platform_drv_registered:1;
u32 hotkey_poll_active:1;
u32 has_adaptive_kbd:1;
u32 kbd_lang:1;
@ -11820,10 +11821,10 @@ static void thinkpad_acpi_module_exit(void)
platform_device_unregister(tpacpi_sensors_pdev);
}
if (tpacpi_pdev) {
if (tp_features.platform_drv_registered)
platform_driver_unregister(&tpacpi_pdriver);
if (tpacpi_pdev)
platform_device_unregister(tpacpi_pdev);
}
if (proc_dir)
remove_proc_entry(TPACPI_PROC_DIR, acpi_root_dir);
@ -11893,9 +11894,8 @@ static int __init tpacpi_pdriver_probe(struct platform_device *pdev)
static int __init tpacpi_hwmon_pdriver_probe(struct platform_device *pdev)
{
tpacpi_hwmon = devm_hwmon_device_register_with_groups(
&tpacpi_sensors_pdev->dev, TPACPI_NAME, NULL, tpacpi_hwmon_groups);
tpacpi_hwmon = devm_hwmon_device_register_with_groups(&pdev->dev, TPACPI_NAME,
NULL, tpacpi_hwmon_groups);
if (IS_ERR(tpacpi_hwmon))
pr_err("unable to register hwmon device\n");
@ -11965,16 +11965,24 @@ static int __init thinkpad_acpi_module_init(void)
tp_features.quirks = dmi_id->driver_data;
/* Device initialization */
tpacpi_pdev = platform_create_bundle(&tpacpi_pdriver, tpacpi_pdriver_probe,
NULL, 0, NULL, 0);
tpacpi_pdev = platform_device_register_simple(TPACPI_DRVR_NAME, PLATFORM_DEVID_NONE,
NULL, 0);
if (IS_ERR(tpacpi_pdev)) {
ret = PTR_ERR(tpacpi_pdev);
tpacpi_pdev = NULL;
pr_err("unable to register platform device/driver bundle\n");
pr_err("unable to register platform device\n");
thinkpad_acpi_module_exit();
return ret;
}
ret = platform_driver_probe(&tpacpi_pdriver, tpacpi_pdriver_probe);
if (ret) {
pr_err("unable to register main platform driver\n");
thinkpad_acpi_module_exit();
return ret;
}
tp_features.platform_drv_registered = 1;
tpacpi_sensors_pdev = platform_create_bundle(&tpacpi_hwmon_pdriver,
tpacpi_hwmon_pdriver_probe,
NULL, 0, NULL, 0);