[PATCH] Input: synaptics-rmi4 - fix NULL dereference in the PM callbacks

rmi_driver_suspend() and rmi_driver_resume() are exported for the
transport drivers; hid-rmi calls them straight from its ->suspend and
->resume. Both reach code that dereferences the driver data right away:

	static int rmi_suspend_functions(struct rmi_device *rmi_dev)
	{
		struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
		...
		list_for_each_entry(entry, &data->function_list, node) {

That data is installed by rmi_driver_probe(), which binds only after the
transport driver has already published rmi_dev via
rmi_register_transport_device(). A runtime PM suspend of the underlying
USB interface in that window dereferences NULL:

	KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
	RIP: 0010:dev_get_drvdata include/linux/device.h:989 [inline]
	RIP: 0010:rmi_suspend_functions drivers/input/rmi4/rmi_driver.c:283 [inline]
	RIP: 0010:rmi_driver_suspend+0x30/0x180 drivers/input/rmi4/rmi_driver.c:994
	Call Trace:
	 <TASK>
	 rmi_suspend+0xa7/0xf0 drivers/hid/hid-rmi.c:448
	 hid_suspend+0x4a3/0x530 drivers/hid/usbhid/hid-core.c:1618
	 usb_suspend_interface drivers/usb/core/driver.c:1323 [inline]
	 usb_suspend_both+0x285/0x1040 drivers/usb/core/driver.c:1446
	 usb_runtime_suspend+0x58/0x110 drivers/usb/core/driver.c:2000
	 rpm_callback drivers/base/power/runtime.c:460 [inline]
	 rpm_suspend+0x8a0/0x17a0 drivers/base/power/runtime.c:698
	 pm_runtime_work+0x132/0x1b0 drivers/base/power/runtime.c
	 </TASK>

rmi_disable_irq() and rmi_enable_irq(), reached a few lines further on,
look the driver data up the same way and then take
&data->enabled_mutex, so they would fault too.

There is nothing to suspend or resume before the driver has bound, so
return success early while the driver data is not there yet.

Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Reported-by: syzbot+09103639e39c989e3ed3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=09103639e39c989e3ed3
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
---
 drivers/input/rmi4/rmi_driver.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 5d49a9021c7d..cff9209ec0b3 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c

@@ -991,6 +991,14 @@ int rmi_driver_suspend(struct rmi_device *rmi_dev, bool enable_wake)
 {
 	int retval;
 
+	/*
+	 * The transport driver registers rmi_dev before this driver has bound
+	 * to it, so a PM transition can reach here while the driver data does
+	 * not exist yet. There is nothing to suspend in that case.
+	 */
+	if (!dev_get_drvdata(&rmi_dev->dev))
+		return 0;
+
 	retval = rmi_suspend_functions(rmi_dev);
 	if (retval)
 		dev_warn(&rmi_dev->dev, "Failed to suspend functions: %d\n",

@@ -1005,6 +1013,9 @@ int rmi_driver_resume(struct rmi_device *rmi_dev, bool clear_wake)
 {
 	int retval;
 
+	if (!dev_get_drvdata(&rmi_dev->dev))
+		return 0;
+
 	rmi_enable_irq(rmi_dev, clear_wake);
 
 	retval = rmi_resume_functions(rmi_dev);

-- 
2.55.0.windows.5