The `cros_ec_keyb` driver can be probed before the cros_ec_device has
completed the registration. This creates a race condition where
`cros_ec_keyb` might access uninitialized data.
Fix this by calling `cros_ec_device_registered()` to check the parent's
status. If the device is not yet ready, return -EPROBE_DEFER to ensure
the probe is retried later.
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
---
drivers/input/keyboard/cros_ec_keyb.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
index c1e53d87c8a7..f7209c8ebbcc 100644
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -705,6 +705,12 @@ static int cros_ec_keyb_probe(struct platform_device *pdev)
ec = dev_get_drvdata(pdev->dev.parent);
if (!ec)
return -EPROBE_DEFER;
+ /*
+ * Even if the cros_ec_device pointer is available, still need to check
+ * if the device is fully registered before using it.
+ */
+ if (!cros_ec_device_registered(ec))
+ return -EPROBE_DEFER;
ckdev = devm_kzalloc(dev, sizeof(*ckdev), GFP_KERNEL);
if (!ckdev)
--
2.51.0.268.g9569e192d0-goog