From: Hamish Martin hamish.martin@alliedtelesis.co.nz
commit f2d4a5834638bbc967371b9168c0b481519f7c5e upstream.
The process of adding an I2C adapter can invoke I2C accesses on that new adapter (see i2c_detect()).
Ensure we have set the adapter's driver data to avoid null pointer dereferences in the xfer functions during the adapter add.
This has been noted in the past and the same fix proposed but not completed. See: https://lore.kernel.org/lkml/ef597e73-ed71-168e-52af-0d19b03734ac@vigem.de/
Signed-off-by: Hamish Martin hamish.martin@alliedtelesis.co.nz Signed-off-by: Jiri Kosina jkosina@suse.cz [Mikhail Lobanov: older kernels use i2c_add_adapter() instead of devm_i2c_add_adapter(). This problem manifests itself in stable kernel branches: https://syzkaller.appspot.com/bug?extid=40dc62a33c759a65ad44, https://syzkaller.appspot.com/bug?extid=24b122f8e84c3f9d9d1d] Signed-off-by: Mikhail Lobanov m.lobanov@rosa.ru --- drivers/hid/hid-mcp2221.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c index 560eeec4035a..b0dc0edc69c2 100644 --- a/drivers/hid/hid-mcp2221.c +++ b/drivers/hid/hid-mcp2221.c @@ -879,12 +879,12 @@ static int mcp2221_probe(struct hid_device *hdev, snprintf(mcp->adapter.name, sizeof(mcp->adapter.name), "MCP2221 usb-i2c bridge");
+ i2c_set_adapdata(&mcp->adapter, mcp); ret = i2c_add_adapter(&mcp->adapter); if (ret) { hid_err(hdev, "can't add usb-i2c adapter: %d\n", ret); goto err_i2c; } - i2c_set_adapdata(&mcp->adapter, mcp);
/* Setup GPIO chip */ mcp->gc = devm_kzalloc(&hdev->dev, sizeof(*mcp->gc), GFP_KERNEL);