github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
master
linux/drivers/input/touchscreen
History
Dmitry Torokhov f5f9e07060 Input: edt-ft5x06 - fix use-after-free in debugfs teardown 
The commit 68743c500c ("Input: edt-ft5x06 - use per-client debugfs
directory") removed the manual debugfs teardown, relying on the I2C core
to handle it. However, this creates a window where debugfs files are
still accessible after edt_ft5x06_ts_teardown_debugfs() frees
tsdata->raw_buffer.

To prevent a use-after-free, protect the freeing of raw_buffer with the
device mutex and set raw_buffer to NULL. The debugfs read function
already checks if raw_buffer is NULL under the same mutex, so this
safely avoids the use-after-free.

Fixes: 68743c500c ("Input: edt-ft5x06 - use per-client debugfs directory")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/adnJicDh-bTUaWXP@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-19 17:54:06 -07:00
..
88pm860x-ts.c Input: 88pm860x - use cleanup facility for device_node 2024-10-19 21:21:41 -07:00
ad7877.c Input: ad7877 - use guard notation when acquiring mutexes/locks 2026-03-24 21:14:18 -07:00
ad7879-i2c.c Input: drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-05-13 15:43:19 -07:00
ad7879-spi.c Input: ad7879 - use device core to create driver-specific device attributes 2023-09-06 14:23:47 -07:00
ad7879.c Input: ad7879 - use guard notation when acquiring mutexes 2026-03-24 21:14:19 -07:00
ad7879.h Input: ad7879 - use device core to create driver-specific device attributes 2023-09-06 14:23:47 -07:00
ads7846.c Input: ads7846 - switch to using cleanup functions 2026-03-24 21:14:20 -07:00
apple_z2.c Input: apple_z2 - fix reading incorrect reports after exiting sleep 2025-12-18 12:17:10 -08:00
ar1021_i2c.c Input: drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-05-13 15:43:19 -07:00
atmel_mxt_ts.c Input: atmel_mxt_ts - switch to using cleanup functions 2026-03-24 21:14:20 -07:00
auo-pixcir-ts.c Input: auo-pixcir-ts - use guard notation when acquiring mutexes 2026-03-24 21:14:21 -07:00
bcm_iproc_tsc.c input: Fix typos in comments across various files 2024-09-30 07:58:33 -07:00
bu21013_ts.c Input: drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-05-13 15:43:19 -07:00
bu21029_ts.c Input: bu21029_ts - use guard notation when acquiring mutex 2026-03-24 21:14:21 -07:00
chipone_icn8318.c Input: chipone_icn8318 - use guard notation when acquiring mutex 2026-03-24 21:14:22 -07:00
chipone_icn8505.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
colibri-vf50-ts.c Input: colibri-vf50-ts - make use of the helper function dev_err_probe() 2024-08-19 10:22:56 -07:00
cy8ctma140.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
cy8ctmg110_ts.c
cyttsp_core.c Input: cyttsp - use guard notation when acquiring mutex 2026-03-24 21:14:23 -07:00
cyttsp_core.h Input: cyttsp4 - remove driver 2024-08-05 10:48:49 -07:00
cyttsp_i2c.c Input: cyttsp4 - remove driver 2024-08-05 10:48:49 -07:00
cyttsp_spi.c
cyttsp5.c Input: cyttsp5 - use %pe format specifier 2025-10-16 22:01:46 -07:00
da9034-ts.c
da9052_tsi.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dynapro.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
edt-ft5x06.c Input: edt-ft5x06 - fix use-after-free in debugfs teardown 2026-04-19 17:54:06 -07:00
eeti_ts.c Input: eeti_ts - use guard notation when acquiring mutexes 2026-03-24 21:14:24 -07:00
egalax_ts_serial.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
egalax_ts.c Input: Use str_enable_disable-like helpers 2025-01-14 13:41:41 -08:00
ektf2127.c Input: ektf2127 - use guard notation when acquiring mutex 2026-03-24 21:14:24 -07:00
elants_i2c.c Input: elants_i2c - switch to using cleanup facilities 2026-03-24 21:14:25 -07:00
elo.c Input: elo - use guard notation when acquiring mutex 2026-03-24 21:14:26 -07:00
exc3000.c Input: exc3000 - use guard notation when acquiring mutex 2026-03-24 21:14:26 -07:00
fsl-imx25-tcq.c Input: remove unneeded 'fast_io' parameter in regmap_config 2025-08-21 12:00:59 -07:00
fujitsu_ts.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
goodix_berlin_core.c Input: goodix-berlin - report a resolution of 10 units/mm 2026-03-25 09:08:17 -07:00
goodix_berlin_i2c.c Input: goodix_berlin - add support for Berlin-A series 2025-03-10 10:46:08 -07:00
goodix_berlin_spi.c Input: goodix_berlin - add support for Berlin-A series 2025-03-10 10:46:08 -07:00
goodix_berlin.h Input: goodix_berlin - add support for Berlin-A series 2025-03-10 10:46:08 -07:00
goodix_fwupload.c Input: goodix - switch to using cleanup functions in firmware code 2026-03-24 21:14:27 -07:00
goodix.c Input: goodix - remove setting of RST pin to input 2025-10-13 09:35:26 -07:00
goodix.h Input: goodix - remove setting of RST pin to input 2025-10-13 09:35:26 -07:00
gunze.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hampshire.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hideep.c Input: hideep - switch to using cleanup functions 2026-03-24 21:14:49 -07:00
himax_hx852x.c Input: add Himax HX852x(ES) touchscreen driver 2025-09-17 14:44:02 -07:00
himax_hx83112b.c Input: himax_hx83112b - fix incorrect size when reading product ID 2024-08-19 17:29:14 -07:00
hp680_ts_input.c
htcpen.c
hycon-hy46xx.c Input: hycon-hy46xx - use guard notation when acquiring mutex 2026-03-24 21:14:49 -07:00
hynitron_cstxxx.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
hynitron-cst816x.c Input: add driver for Hynitron CST816x series 2025-09-24 22:36:50 -07:00
ili210x.c Input: ili210x - add support for polling mode 2026-01-21 16:17:51 -08:00
ilitek_ts_i2c.c Input: ilitek_ts_i2c - switch mdelay() to fsleep() 2025-12-18 21:46:55 -08:00
imagis.c Input: imagis - use guard notation when acquiring mutex 2026-03-24 21:14:50 -07:00
imx6ul_tsc.c Input: imx6ul_tsc - use guard notation when acquiring mutex 2026-03-24 21:14:50 -07:00
inexio.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ipaq-micro-ts.c Input: ipaq-micro-ts - use guard notation when acquiring mutex/spinlock 2026-03-24 21:14:51 -07:00
iqs5xx.c Input: iqs5xx - simplify parsing of firmware blob 2026-03-24 21:14:52 -07:00
iqs7211.c Input: iqs7211 - use cleanup facility for fwnodes 2026-03-24 21:14:53 -07:00
jornada720_ts.c
Kconfig Input: mk712 - remove driver 2026-04-08 07:55:25 -07:00
lpc32xx_ts.c Input: lpc32xx_ts - use guard notation when acquiring mutex 2026-03-24 21:14:53 -07:00
mainstone-wm97xx.c Input: switch back to struct platform_driver::remove() 2024-10-15 11:43:25 -07:00
Makefile Input: mk712 - remove driver 2026-04-08 07:55:25 -07:00
max11801_ts.c Input: drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-05-13 15:43:19 -07:00
mc13783_ts.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
melfas_mip4.c Input: melfas_mip4 - switch to using cleanup functions 2026-03-24 21:14:54 -07:00
migor_ts.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mms114.c Input: mms114 - use guard notation when acquiring mutex 2026-03-24 21:14:55 -07:00
msg2638.c Input: msg2638 - use guard notation when acquiring mutex 2026-03-24 21:14:56 -07:00
mtouch.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mxs-lradc-ts.c Input: mxs-lradc-ts - use guard notation when acquiring spinlock 2026-03-25 07:53:57 -07:00
novatek-nvt-ts.c Input: novatek-nvt-ts - use guard notation when acquiring mutex 2026-03-25 07:53:58 -07:00
pcap_ts.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
penmount.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pixcir_i2c_ts.c Input: pixcir_i2c_ts - use guard notation when acquiring mutex 2026-03-25 07:53:58 -07:00
raspberrypi-ts.c Input: raspberrypi-ts - use cleanup facility for device_node 2024-10-19 21:21:43 -07:00
raydium_i2c_ts.c Input: raydium_i2c_ts - switch to using cleanup functions 2026-03-25 07:53:58 -07:00
resistive-adc-touch.c
rohm_bu21023.c input: Fix typos in comments across various files 2024-09-30 07:58:33 -07:00
s6sy761.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
silead.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
sis_i2c.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
st1232.c Input: st1232 - expose firmware version via sysfs 2026-02-17 23:04:43 -08:00
stmfts.c Input: stmfts - use guard notation when acquiring mutex 2026-03-25 07:53:58 -07:00
stmpe-ts.c Input: stmpe-ts - use module alias instead of device table 2025-04-28 12:14:12 -07:00
sun4i-ts.c Input: switch back to struct platform_driver::remove() 2024-10-15 11:43:25 -07:00
sur40.c Input: sur40 - use guard notation when acquiring spinlock 2026-03-25 07:53:59 -07:00
surface3_spi.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
sx8654.c Input: sx8654 - use IRQF_NOAUTOEN when requesting interrupt 2026-03-25 07:53:59 -07:00
ti_am335x_tsc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
touchit213.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
touchright.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
touchwin.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
tps6507x-ts.c
ts4800-ts.c Input: ts4800-ts - use cleanup facility for device_node 2024-10-19 21:21:43 -07:00
tsc40.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
tsc200x-core.c Input: include export.h in modules using EXPORT_SYMBOL*() 2025-08-21 12:00:59 -07:00
tsc200x-core.h Input: tsc2004/5 - fix handling of VIO power supply 2024-08-04 18:10:40 -07:00
tsc2004.c Input: tsc2004/5 - fix handling of VIO power supply 2024-08-04 18:10:40 -07:00
tsc2005.c Input: tsc2004/5 - fix handling of VIO power supply 2024-08-04 18:10:40 -07:00
tsc2007_core.c Input: tsc2007 - use guard notation when acquiring mutexes 2026-03-25 07:53:59 -07:00
tsc2007_iio.c Input: tsc2007 - use guard notation when acquiring mutexes 2026-03-25 07:53:59 -07:00
tsc2007.h Input: tsc2007 - accept standard properties 2024-12-10 16:17:30 -08:00
usbtouchscreen.c Input: usbtouchscreen - refactor endpoint lookup 2026-04-01 10:37:38 -07:00
wacom_i2c.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
wacom_w8001.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
wdt87xx_i2c.c Input: wdt87xx_i2c - switch to using cleanup functions 2026-03-25 07:53:59 -07:00
wm97xx-core.c Input: wm97xx - use guard notation when acquiring mutex 2026-03-25 07:54:00 -07:00
wm831x-ts.c Input: switch back to struct platform_driver::remove() 2024-10-15 11:43:25 -07:00
wm9705.c Input: include export.h in modules using EXPORT_SYMBOL*() 2025-08-21 12:00:59 -07:00
wm9712.c Input: include export.h in modules using EXPORT_SYMBOL*() 2025-08-21 12:00:59 -07:00
wm9713.c Input: include export.h in modules using EXPORT_SYMBOL*() 2025-08-21 12:00:59 -07:00
zet6223.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
zforce_ts.c Input: zforce_ts - omit error message when memory allocation fails 2025-10-17 21:43:06 -07:00
zinitix.c Input: zinitix - use guard notation when acquiring mutex 2026-03-25 07:54:00 -07:00