Patch "HID: multitouch: Correct devm device reference for hidinput input_dev name" has been added to the 6.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    HID: multitouch: Correct devm device reference for hidinput input_dev name

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hid-multitouch-correct-devm-device-reference-for-hid.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ad5909189a22ac695996ca8b1888ba316756698f
Author: Rahul Rameshbabu <sergeantsagara@xxxxxxxxxxxxxx>
Date:   Thu Aug 24 06:14:33 2023 +0000

    HID: multitouch: Correct devm device reference for hidinput input_dev name
    
    [ Upstream commit 4794394635293a3e74591351fff469cea7ad15a2 ]
    
    Reference the HID device rather than the input device for the devm
    allocation of the input_dev name. Referencing the input_dev would lead to a
    use-after-free when the input_dev was unregistered and subsequently fires a
    uevent that depends on the name. At the point of firing the uevent, the
    name would be freed by devres management.
    
    Use devm_kasprintf to simplify the logic for allocating memory and
    formatting the input_dev name string.
    
    Reported-by: Maxime Ripard <mripard@xxxxxxxxxx>
    Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae
    Fixes: c08d46aa805b ("HID: multitouch: devm conversion")
    Suggested-by: Maxime Ripard <mripard@xxxxxxxxxx>
    Suggested-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
    Signed-off-by: Rahul Rameshbabu <sergeantsagara@xxxxxxxxxxxxxx>
    Reviewed-by: Maxime Ripard <mripard@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230824061308.222021-3-sergeantsagara@xxxxxxxxxxxxxx
    Signed-off-by: Benjamin Tissoires <bentiss@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index e31be0cb8b850..521b2ffb42449 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1594,7 +1594,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app)
 static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
 {
 	struct mt_device *td = hid_get_drvdata(hdev);
-	char *name;
 	const char *suffix = NULL;
 	struct mt_report_data *rdata;
 	struct mt_application *mt_application = NULL;
@@ -1645,15 +1644,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
 		break;
 	}
 
-	if (suffix) {
-		name = devm_kzalloc(&hi->input->dev,
-				    strlen(hdev->name) + strlen(suffix) + 2,
-				    GFP_KERNEL);
-		if (name) {
-			sprintf(name, "%s %s", hdev->name, suffix);
-			hi->input->name = name;
-		}
-	}
+	if (suffix)
+		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
+						 "%s %s", hdev->name, suffix);
 
 	return 0;
 }