diff mbox series

[5.10/5.15/6.1] HID: mcp2221: Set driver data before I2C adapter add

Message ID 20250401094752.8324-1-m.lobanov@rosa.ru (mailing list archive)
State New
Delegated to: Jiri Kosina
Headers show
Series [5.10/5.15/6.1] HID: mcp2221: Set driver data before I2C adapter add | expand

Commit Message

Mikhail Lobanov April 1, 2025, 9:47 a.m. UTC 
From: Hamish Martin <hamish.martin@alliedtelesis.co.nz>

commit f2d4a5834638bbc967371b9168c0b481519f7c5e upstream.

The process of adding an I2C adapter can invoke I2C accesses on that new
adapter (see i2c_detect()).

Ensure we have set the adapter's driver data to avoid null pointer
dereferences in the xfer functions during the adapter add.

This has been noted in the past and the same fix proposed but not
completed. See:
https://lore.kernel.org/lkml/ef597e73-ed71-168e-52af-0d19b03734ac@vigem.de/

Signed-off-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
[Mikhail Lobanov: older kernels use i2c_add_adapter() instead of
devm_i2c_add_adapter().
This problem manifests itself in stable kernel branches:
https://syzkaller.appspot.com/bug?extid=40dc62a33c759a65ad44,
https://syzkaller.appspot.com/bug?extid=24b122f8e84c3f9d9d1d]
Signed-off-by: Mikhail Lobanov <m.lobanov@rosa.ru>
---
 drivers/hid/hid-mcp2221.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c
index 560eeec4035a..b0dc0edc69c2 100644
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -879,12 +879,12 @@  static int mcp2221_probe(struct hid_device *hdev,
 	snprintf(mcp->adapter.name, sizeof(mcp->adapter.name),
 			"MCP2221 usb-i2c bridge");
 
+	i2c_set_adapdata(&mcp->adapter, mcp);
 	ret = i2c_add_adapter(&mcp->adapter);
 	if (ret) {
 		hid_err(hdev, "can't add usb-i2c adapter: %d\n", ret);
 		goto err_i2c;
 	}
-	i2c_set_adapdata(&mcp->adapter, mcp);
 
 	/* Setup GPIO chip */
 	mcp->gc = devm_kzalloc(&hdev->dev, sizeof(*mcp->gc), GFP_KERNEL);