[PATCH] HID: multitouch: use GFP_ATOMIC for report/application/usage allocations
From: Nguyen Ngoc Thang <hidden>
Date: 2026-09-10 15:37:52
Also in:
lkml
Subsystem:
hid core layer, the rest · Maintainers:
Jiri Kosina, Benjamin Tissoires, Linus Torvalds
mt_allocate_report_data(), mt_allocate_application() and
mt_allocate_usage() devm_kzalloc() with GFP_KERNEL, but they are
reachable from mt_event()/mt_report() via hid_report_raw_event(),
which can run in (soft)irq context off a USB URB completion (e.g.
dummy_hcd's hrtimer softirq). GFP_KERNEL there may call into
fs_reclaim, which lockdep flags as an inconsistent {SOFTIRQ-ON-W} ->
{IN-SOFTIRQ-W} use of fs_reclaim, alongside a "sleeping function
called from invalid context" splat.
Switch all three to GFP_ATOMIC since none of them are on a path that
needs to sleep.
Reported-by: syzbot+093e05755c2d99caab91@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=093e05755c2d99caab91
Signed-off-by: Nguyen Ngoc Thang <redacted>
---
drivers/hid/hid-multitouch.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 2c41bacab1ca..6b68e43fd885 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c@@ -604,7 +604,8 @@ static struct mt_usages *mt_allocate_usage(struct hid_device *hdev, { struct mt_usages *usage; - usage = devm_kzalloc(&hdev->dev, sizeof(*usage), GFP_KERNEL); + /* may run from hid_report_raw_event() in (soft)irq context */ + usage = devm_kzalloc(&hdev->dev, sizeof(*usage), GFP_ATOMIC); if (!usage) return NULL;
@@ -633,8 +634,9 @@ static struct mt_application *mt_allocate_application(struct mt_device *td, unsigned int application = report->application; struct mt_application *mt_application; + /* may run from hid_report_raw_event() in (soft)irq context */ mt_application = devm_kzalloc(&td->hdev->dev, sizeof(*mt_application), - GFP_KERNEL); + GFP_ATOMIC); if (!mt_application) return NULL;
@@ -692,7 +694,8 @@ static struct mt_report_data *mt_allocate_report_data(struct mt_device *td, struct hid_field *field; int r, n; - rdata = devm_kzalloc(&td->hdev->dev, sizeof(*rdata), GFP_KERNEL); + /* may run from hid_report_raw_event() in (soft)irq context */ + rdata = devm_kzalloc(&td->hdev->dev, sizeof(*rdata), GFP_ATOMIC); if (!rdata) return NULL;
--
2.43.0