mt_allocate_report_data(), mt_allocate_application() and
mt_allocate_usage() devm_kzalloc() with GFP_KERNEL, but they are
reachable from mt_event()/mt_report() via hid_report_raw_event(),
which can run in (soft)irq context off a USB URB completion (e.g.
dummy_hcd's hrtimer softirq). GFP_KERNEL there may call into
fs_reclaim, which lockdep flags as an inconsistent {SOFTIRQ-ON-W} ->
{IN-SOFTIRQ-W} use of fs_reclaim, alongside a "sleeping function
called from invalid context" splat.

Switch all three to GFP_ATOMIC since none of them are on a path that
needs to sleep.

Reported-by: syzbot+093e05755c2d99caab91@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=093e05755c2d99caab91
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
 drivers/hid/hid-multitouch.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 2c41bacab1ca..6b68e43fd885 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -604,7 +604,8 @@ static struct mt_usages *mt_allocate_usage(struct hid_device *hdev,
 {
 	struct mt_usages *usage;
 
-	usage = devm_kzalloc(&hdev->dev, sizeof(*usage), GFP_KERNEL);
+	/* may run from hid_report_raw_event() in (soft)irq context */
+	usage = devm_kzalloc(&hdev->dev, sizeof(*usage), GFP_ATOMIC);
 	if (!usage)
 		return NULL;
 
@@ -633,8 +634,9 @@ static struct mt_application *mt_allocate_application(struct mt_device *td,
 	unsigned int application = report->application;
 	struct mt_application *mt_application;
 
+	/* may run from hid_report_raw_event() in (soft)irq context */
 	mt_application = devm_kzalloc(&td->hdev->dev, sizeof(*mt_application),
-				      GFP_KERNEL);
+				      GFP_ATOMIC);
 	if (!mt_application)
 		return NULL;
 
@@ -692,7 +694,8 @@ static struct mt_report_data *mt_allocate_report_data(struct mt_device *td,
 	struct hid_field *field;
 	int r, n;
 
-	rdata = devm_kzalloc(&td->hdev->dev, sizeof(*rdata), GFP_KERNEL);
+	/* may run from hid_report_raw_event() in (soft)irq context */
+	rdata = devm_kzalloc(&td->hdev->dev, sizeof(*rdata), GFP_ATOMIC);
 	if (!rdata)
 		return NULL;
 
-- 
2.43.0