Re: [PATCH] Input: atmel_mxt_ts - fix NULL pointer dereference in mxt_object_show

[齐柯宇]

Hi Dmitry,

Thank you for the review.

You're absolutely right. The NULL check only narrows the race window but
does not eliminate the race condition - the pointers can still be
invalidated between the check and the actual dereference.

I will rework the patch with proper synchronization to fully address this
issue.

regards,

Kery

Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx> 于2026年1月21日周三 02:22写道：

>
> Hi,
>
> On Thu, Jan 15, 2026 at 03:43:37AM +0800, 齐柯宇 wrote:
> > diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c
> > b/drivers/input/touchscreen/atmel_mxt_ts.c
> > index dd0544cc1bc1..401fcae2264d 100644
> > --- a/drivers/input/touchscreen/atmel_mxt_ts.c
> > +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
> > @@ -2859,6 +2859,10 @@ static ssize_t mxt_object_show(struct device *dev,
> >   int error;
> >   u8 *obuf;
> >
> > + /* Check for NULL to prevent race condition during firmware update */
> > + if (!data->info || !data->object_table)
> > +   return -ENODEV;
> > +
>
> What stops the pointers from being invalidated right here?
>
> >   /* Pre-allocate buffer large enough to hold max sized object. */
> >   obuf = kmalloc(256, GFP_KERNEL);
> >   if (!obuf)
>
> Thanks.
>
> --
> Dmitry