[PATCH v2 0/3] Input: applespi - fixes for DMA timeout, UAF, and NULL pointer dereference

[Shih-Yuan Lee]

Hi Dmitry and the linux-input community,

This patch series addresses a long-standing DMA initialization timeout on the 
early 2015 12" MacBook (MacBook8,1) as well as two pre-existing, high-severity 
UAF/NULL-pointer bugs in the applespi driver.

Changes in v2:
  - Fixed an unbind/remove execute-after-free vulnerability by storing and 
    restoring the host controller's original can_dma callback in applespi_probe() 
    and applespi_remove().
  - Split the fixes into a 3-patch logical series: Patch 1 introduces the 
    MacBook8,1 DMI quirk and its unbind safety, Patch 2 cancels pending work 
    synchronously on remove (UAF fix), and Patch 3 protects the debugfs open 
    handler (NULL pointer fix).

Patch 1 introduces a DMI quirk inside applespi.c that overrides the SPI 
controller's can_dma callback to a custom helper that always returns false 
for MacBook8,1. This forces the controller to use the rock-solid PIO mode 
specifically for this device. To prevent an execute-after-free vulnerability 
upon module unload or unbind, it preserves and restores the original can_dma 
callback.

Patch 2 fixes a pre-existing UAF vulnerability in the driver unbind path by 
explicitly calling cancel_work_sync() on the asynchronous registration worker 
work struct before devres frees the driver private data.

Patch 3 fixes a pre-existing race condition in the debugfs interface where 
userspace could open the tp_dim file before the asynchronous worker has 
finished initializing applespi->touchpad_input_dev, leading to a NULL 
pointer dereference. We resolve this using smp_load_acquire() and checking 
for NULL.

Best regards,
Shih-Yuan Lee

Shih-Yuan Lee (3):
  Input: applespi - force PIO mode on MacBook8,1
  Input: applespi - cancel pending work on driver remove
  Input: applespi - fix NULL pointer dereference in tp_dim open

 drivers/input/keyboard/applespi.c | 38 ++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

-- 
2.39.5