Re: [PATCH 03/10] Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
From: sashiko-bot@kernel.org
Date: 2026-06-26 05:31:28
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: Pre-existing issues: - [High] Devm-managed V4L2 video_device leads to Use-After-Free on deferred file close. - [Medium] Missing vb2_queue_release() leaks videobuf2 resources during device unbind. -- commit 7c7a1b6617a82d10a8cfe2c055e62e4a1c8fe287 Author: Bryam Vargas [off-list ref] Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer This commit prevents a buffer overflow in rmi_f54_work() by rejecting reports that are larger than the allocated size of f54->report_data. It records the allocation size during probe and ensures the report_size does not exceed it.
quoted hunk ↗ jump to hunk
diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c index 8eac320c43e35..75839a54656b9 100644 --- a/drivers/input/rmi4/rmi_f54.c +++ b/drivers/input/rmi4/rmi_f54.c@@ -104,6 +104,7 @@ struct f54_data { enum rmi_f54_report_type report_type; u8 *report_data; + size_t max_report_size; int report_size; bool is_busy;
[Severity: High] This isn't a bug introduced by this patch, but looking at struct f54_data which embeds struct video_device vdev, can its devm-managed lifecycle lead to a use-after-free on a deferred file close? If a user holds the video node open while the device is unbound, rmi_f54_remove() calls video_unregister_device(&f54->vdev). Devres will then free struct f54_data immediately upon return. When the user later closes the file descriptor, will the V4L2 core access the freed video_device to decrement its kref and invoke the release callback? [Severity: Medium] This is a pre-existing issue, but does rmi_f54_remove() leak videobuf2 resources during device unbind? The teardown path unregisters the video device with video_unregister_device(&f54->vdev). If userspace requests buffers (e.g., via VIDIOC_REQBUFS) and the device is subsequently unbound without the application cleanly releasing the buffers, will the driver leak the videobuf2 kernel resources and allocated buffers since it fails to call vb2_queue_release()? [ ... ] -- Sashiko AI review · https://sashiko.dev/#/patchset/20260626051802.4033172-1-dmitry.torokhov@gmail.com?part=3