Re: [PATCH] Input: synaptics-rmi4 - fix NULL dereference in the PM callbacks

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

Hi Yogesh,

On Tue, Sep 08, 2026 at 10:29:25PM +0530, Yogesh Gaur wrote:
> rmi_driver_suspend() and rmi_driver_resume() are exported for the
> transport drivers; hid-rmi calls them straight from its ->suspend and
> ->resume. Both reach code that dereferences the driver data right away:
> 
> 	static int rmi_suspend_functions(struct rmi_device *rmi_dev)
> 	{
> 		struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
> 		...
> 		list_for_each_entry(entry, &data->function_list, node) {
> 
> That data is installed by rmi_driver_probe(), which binds only after the
> transport driver has already published rmi_dev via
> rmi_register_transport_device(). A runtime PM suspend of the underlying
> USB interface in that window dereferences NULL:
> 
> 	KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
> 	RIP: 0010:dev_get_drvdata include/linux/device.h:989 [inline]
> 	RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:283 [inline]
> 	RIP: 0010:rmi_driver_suspend+0x30/0x180 drivers/input/rmi4/rmi_driver.c:994
> 	Call Trace:
> 	 <TASK>
> 	 rmi_suspend+0xa7/0xf0 drivers/hid/hid-rmi.c:448
> 	 hid_suspend+0x4a3/0x530 drivers/hid/usbhid/hid-core.c:1618
> 	 usb_suspend_interface drivers/usb/core/driver.c:1323 [inline]
> 	 usb_suspend_both+0x285/0x1040 drivers/usb/core/driver.c:1446
> 	 usb_runtime_suspend+0x58/0x110 drivers/usb/core/driver.c:2000
> 	 rpm_callback drivers/base/power/runtime.c:460 [inline]
> 	 rpm_suspend+0x8a0/0x17a0 drivers/base/power/runtime.c:698
> 	 pm_runtime_work+0x132/0x1b0 drivers/base/power/runtime.c
> 	 </TASK>
> 
> rmi_disable_irq() and rmi_enable_irq(), reached a few lines further on,
> look the driver data up the same way and then take
> &data->enabled_mutex, so they would fault too.
> 
> There is nothing to suspend or resume before the driver has bound, so
> return success early while the driver data is not there yet.
> 
> Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
> Reported-by: syzbot+09103639e39c989e3ed3@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=09103639e39c989e3ed3
> Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>

Thank you for the patch, but I already have a fix for this:

https://patch.msgid.link/anQe8UiyUR4x0flD@google.com

Thanks.

-- 
Dmitry