[PATCH 2/2] HID: lenovo: allocate the trackpoint drvdata before exposing its sysfs attributes

[Oleg Keri]

lenovo_probe_tpkbd() creates its sysfs group before allocating the
lenovo_drvdata that every attribute handler dereferences through
hid_get_drvdata(), and drvdata is explicitly NULL at that point.  A read of
e.g. the sensitivity attribute between the two steps is a NULL pointer
dereference.

Allocate and install the drvdata first, then create the group.  The
allocation failure path no longer has a group to remove, so it returns
directly.

Fixes: c1dcad2d32d0 ("HID: Driver for Lenovo Keyboard with Trackpoint")
Link: https://lore.kernel.org/all/20260910064345.9BF1E1F000FF@xxxxxxxxxxxxxxx/
Signed-off-by: Oleg Keri <okerixx@xxxxxxxxx>
---
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
index ff7c5ef..62bb805 100644
--- a/drivers/hid/hid-lenovo.c
+++ b/drivers/hid/hid-lenovo.c
@@ -1253,17 +1253,12 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev)
 	if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 3, 0, 2))
 		return -ENODEV;
 
-	ret = sysfs_create_group(&hdev->dev.kobj, &lenovo_attr_group_tpkbd);
-	if (ret)
-		hid_warn(hdev, "Could not create sysfs group: %d\n", ret);
-
 	data_pointer = devm_kzalloc(&hdev->dev,
 				    sizeof(struct lenovo_drvdata),
 				    GFP_KERNEL);
 	if (data_pointer == NULL) {
 		hid_err(hdev, "Could not allocate memory for driver data\n");
-		ret = -ENOMEM;
-		goto err;
+		return -ENOMEM;
 	}
 
 	// set same default values as windows driver
@@ -1272,6 +1267,10 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev)
 
 	hid_set_drvdata(hdev, data_pointer);
 
+	ret = sysfs_create_group(&hdev->dev.kobj, &lenovo_attr_group_tpkbd);
+	if (ret)
+		hid_warn(hdev, "Could not create sysfs group: %d\n", ret);
+
 	ret = lenovo_register_leds(hdev);
 	if (ret)
 		goto err;
-- 
2.55.0