[PATCH] Input: smbus companion - store the platform data for later use

From: Benjamin Tissoires
Date: Fri Mar 10 2017 - 12:31:01 EST


The platform data should be available as long as the i2c_device exists.
In the current implementation, the platform data is allocated on the
stack, which gives a dangling pointer to the i2c_client once
psmouse_smbus_init() ends.

Duplicate the provided platform data in psmouse_smbus_init() so that
the allocation/free of pdata is handled by psmouse-smbus.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@xxxxxxxxxx>
---
drivers/input/mouse/psmouse-smbus.c | 18 ++++++++++++++++--
drivers/input/mouse/psmouse.h | 2 +-
drivers/input/mouse/synaptics.c | 5 ++---
3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/drivers/input/mouse/psmouse-smbus.c b/drivers/input/mouse/psmouse-smbus.c
index 5bda551..6f603ec 100644
--- a/drivers/input/mouse/psmouse-smbus.c
+++ b/drivers/input/mouse/psmouse-smbus.c
@@ -20,6 +20,7 @@
struct psmouse_smbus_dev {
struct psmouse *psmouse;
struct i2c_client *client;
+ void *pdata;
struct list_head node;
unsigned short addr;
bool dead;
@@ -166,6 +167,7 @@ static void psmouse_smbus_disconnect(struct psmouse *psmouse)
psmouse_smbus_schedule_remove(smbdev->client);
}

+ kfree(smbdev->pdata);
kfree(smbdev);
psmouse->private = NULL;
}
@@ -205,6 +207,7 @@ void psmouse_smbus_cleanup(struct psmouse *psmouse)
list_for_each_entry_safe(smbdev, tmp, &psmouse_smbus_list, node) {
if (psmouse == smbdev->psmouse) {
list_del(&smbdev->node);
+ kfree(smbdev->pdata);
kfree(smbdev);
}
}
@@ -213,16 +216,26 @@ void psmouse_smbus_cleanup(struct psmouse *psmouse)
}

int psmouse_smbus_init(struct psmouse *psmouse, struct i2c_board_info *board,
- bool leave_breadcrumbs)
+ void *pdata, size_t pdata_size, bool leave_breadcrumbs)
{
struct psmouse_smbus_companion_req req;
struct psmouse_smbus_dev *smbdev;
+ struct i2c_board_info _board;
int error;

smbdev = kzalloc(sizeof(*smbdev), GFP_KERNEL);
if (!smbdev)
return -ENOMEM;

+ smbdev->pdata = kmemdup(pdata, pdata_size, GFP_KERNEL);
+ if (!smbdev->pdata) {
+ kfree(smbdev);
+ return -ENOMEM;
+ }
+
+ _board = *board;
+ _board.platform_data = smbdev->pdata;
+
smbdev->psmouse = psmouse;
smbdev->addr = board->addr;

@@ -240,7 +253,7 @@ int psmouse_smbus_init(struct psmouse *psmouse, struct i2c_board_info *board,
mutex_unlock(&psmouse_smbus_mutex);

/* Bind to already existing adapters right away */
- req.board = board;
+ req.board = &_board;
req.client = &smbdev->client;
error = i2c_for_each_dev(&req, psmouse_smbus_create_companion);

@@ -254,6 +267,7 @@ int psmouse_smbus_init(struct psmouse *psmouse, struct i2c_board_info *board,
list_del(&smbdev->node);
mutex_unlock(&psmouse_smbus_mutex);

+ kfree(smbdev->pdata);
kfree(smbdev);
}

diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
index 60e5e8d..a572e66 100644
--- a/drivers/input/mouse/psmouse.h
+++ b/drivers/input/mouse/psmouse.h
@@ -219,7 +219,7 @@ void psmouse_smbus_module_exit(void);
struct i2c_board_info;

int psmouse_smbus_init(struct psmouse *psmouse, struct i2c_board_info *board,
- bool leave_breadcrumbs);
+ void *pdata, size_t pdata_size, bool leave_breadcrumbs);
void psmouse_smbus_cleanup(struct psmouse *psmouse);

#else /* !CONFIG_MOUSE_PS2_SMBUS */
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 5807504..95cdf21 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1708,12 +1708,11 @@ static int synaptics_create_intertouch(struct psmouse *psmouse,
};
struct i2c_board_info intertouch_board = {
I2C_BOARD_INFO("rmi4_smbus", 0x2c),
- .platform_data = &pdata,
.flags = I2C_CLIENT_HOST_NOTIFY,
};

- return psmouse_smbus_init(psmouse, &intertouch_board,
- leave_breadcrumbs);
+ return psmouse_smbus_init(psmouse, &intertouch_board, &pdata,
+ sizeof(pdata), leave_breadcrumbs);
}

/**
--
2.9.3

Cheers,
Benjamin