Re: [PATCH 2/2] Input: synaptics-rmi4 - reject a PDT that grows between scans

[Wei Jie Law]

Superseded by v2 2/2:
https://lore.kernel.org/linux-input/20260824122733.76321-3-98lawweijie@xxxxxxxxx/

Please do not apply this version.  The rejection path it adds calls
put_device(&fn->dev) before rmi_register_function(), which is where
device_initialize() happens, so fn->dev is still all zeroes at that
point.  kobject_put() then warns that the kobject was never initialised,
refcount_dec_and_test() warns about the underflow, and because the
saturated refcount makes kref_put() return false the release never runs
-- so the function is leaked on every rejection, i.e. on exactly the
malicious device this patch is meant to reject:

  rmi4_physical rmi4-00: F40: interrupt count changed between PDT scans (pos 1 + 6 > 1)
  kobject: '(null)' (00000000cfabc269): is not initialized, yet kobject_put() is being called.
  WARNING: CPU: 0 PID: 9 at lib/kobject.c:734 kobject_put+0x1cf/0x4b0
  refcount_t: underflow; use-after-free.
  WARNING: CPU: 0 PID: 9 at lib/refcount.c:28 refcount_warn_saturate+0xf2/0x150

v2 uses kfree() instead.

Please mark this one superseded.

Thanks,
Wei Jie