On Tue, Sep 03, 2024 at 05:33:23PM -0400, Richard Acayan wrote:
> On Tue, Sep 03, 2024 at 11:40:38AM -0700, Dmitry Torokhov wrote:
> > On Tue, Sep 03, 2024 at 02:07:23PM -0400, Richard Acayan wrote:
> > > > + /* Use the Query DPM feature when the query register exists for resolution. */
> > > > + item = rmi_get_register_desc_item(&f12->query_reg_desc, RMI_F12_QUERY_RESOLUTION);
> > > > + if (item) {
> > > > + offset = rmi_register_desc_calc_reg_offset(&f12->query_reg_desc,
> > > > + RMI_F12_QUERY_RESOLUTION);
> > > > + query_dpm_addr = fn->fd.query_base_addr + offset;
> > > > + ret = rmi_read(fn->rmi_dev, query_dpm_addr, buf);
> > > > + if (ret < 0) {
> > > > + dev_err(&fn->dev, "Failed to read DPM value: %d\n", ret);
> > > > + return -ENODEV;
> > > > + }
> > > > + dpm_resolution = buf[0];
> > > > +
> > > > + sensor->x_mm = sensor->max_x / dpm_resolution;
> > > > + sensor->y_mm = sensor->max_y / dpm_resolution;
> > > > + } else {
> > > > + if (rmi_register_desc_has_subpacket(item, 3)) {
> > >
> > > The item variable is NULL in this branch, as it was overwritten just
> > > before the if statement.
> > >
> > > This patch causes a NULL pointer dereference:
> >
> > Ugh, indeed. I guess the simplest way of fixing this would be:
> >
> > diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
> > index fc2cc8e2b0ba..8246fe77114b 100644
> > --- a/drivers/input/rmi4/rmi_f12.c
> > +++ b/drivers/input/rmi4/rmi_f12.c
> > @@ -129,9 +129,8 @@ static int rmi_f12_read_sensor_tuning(struct f12_data *f12)
> > * Use the Query DPM feature when the resolution query register
> > * exists.
> > */
> > - item = rmi_get_register_desc_item(&f12->query_reg_desc,
> > - RMI_F12_QUERY_RESOLUTION);
> > - if (item) {
> > + if (rmi_get_register_desc_item(&f12->query_reg_desc,
> > + RMI_F12_QUERY_RESOLUTION)) {
> > offset = rmi_register_desc_calc_reg_offset(&f12->query_reg_desc,
> > RMI_F12_QUERY_RESOLUTION);
> > query_dpm_addr = fn->fd.query_base_addr + offset;
> >
> > Could you please tell me if this works for you?
>
> Yeah, it fixes the bug.
Great, thank you for reporting and testing!
--
Dmitry
