The threaded click handler ignores the status returned when reading
CLICK_SRC. With the SPI transport, spi_w8r8() can fail without storing
anything in the output byte. The handler then tests an uninitialized
click_src and can report spurious axis button events.
Check the read status and skip the event when CLICK_SRC cannot be
fetched. Exit through the common unlock path so successful event
handling and mutex coverage remain unchanged.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 6d94d4081048 ("lis3: interrupt handlers for 8bit wakeup and click events")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
drivers/misc/lis3lv02d/lis3lv02d.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
index 21e8ad0a74442..450a0bf15bdcd 100644
--- a/drivers/misc/lis3lv02d/lis3lv02d.c
+++ b/drivers/misc/lis3lv02d/lis3lv02d.c
@@ -511,7 +511,8 @@ static void lis302dl_interrupt_handle_click(struct lis3lv02d *lis3)
u8 click_src;
mutex_lock(&lis3->mutex);
- lis3->read(lis3, CLICK_SRC, &click_src);
+ if (lis3->read(lis3, CLICK_SRC, &click_src) < 0)
+ goto out;
if (click_src & CLICK_SINGLE_X) {
input_report_key(dev, lis3->mapped_btns[0], 1);
@@ -528,6 +529,7 @@ static void lis302dl_interrupt_handle_click(struct lis3lv02d *lis3)
input_report_key(dev, lis3->mapped_btns[2], 0);
}
input_sync(dev);
+out:
mutex_unlock(&lis3->mutex);
}
--
2.51.0