This fix was discovered through static code analysis.

In mxt_object_show(), the code directly dereferences data->info and
data->object_table without checking if they are NULL. This can lead to
a NULL pointer dereference kernel crash when the sysfs file is accessed
during firmware update or device removal.

[Call Chain Analysis]
The vulnerable sysfs handler is exposed through the following registration:

  Driver registration:
    mxt_driver.driver.dev_groups = mxt_groups
      -> mxt_attrs[] contains:
         - dev_attr_object.attr     -> mxt_object_show()     [VULNERABLE]
         - dev_attr_update_fw.attr  -> mxt_update_fw_store()
                                                           [TRIGGERS FREE]

  Initialization path:
    mxt_probe()
      -> mxt_initialize()
        -> mxt_read_info_block()
          -> data->info = (struct mxt_info *)id_buf        [line 1918]
          -> data->object_table = (struct mxt_object *)... [line 1934]

  Resource release path (called during firmware update or device removal):
    mxt_update_fw_store() OR mxt_remove()
      -> mxt_free_object_table()
        -> data->object_table = NULL  [line 1713]
        -> data->info = NULL          [line 1714]

[Data Flow Analysis]
The critical data flow is:

  data->info:
    - Allocated and set in mxt_read_info_block() from id_buf
    - Released and set to NULL in mxt_free_object_table()
    - Accessed in mxt_object_show() at line 2868: data->info->object_num

  data->object_table:
    - Set in mxt_read_info_block() as pointer into id_buf
    - Set to NULL in mxt_free_object_table()
    - Accessed in mxt_object_show() at line 2869: data->object_table + i

[Race Condition Scenario]
The vulnerability can be triggered by the following race condition:

  Thread A (reading sysfs)           Thread B (firmware update)
  --------------------------         --------------------------
  T1: open /sys/.../object
  T2: mxt_object_show()
  T3: data = dev_get_drvdata(dev)
  T4: obuf = kmalloc(...)
                                     T5: echo fw > /sys/.../update_fw
                                     T6: mxt_update_fw_store()
                                     T7: mxt_free_object_table()
                                     T8: data->info = NULL
  T9: for (i < data->info->object_num)
      -> NULL pointer dereference!

[User-Triggerable Paths]
Users can trigger this vulnerability through:

  1. Firmware update race condition (requires root):
     Terminal A: # cat /sys/bus/i2c/devices/<dev>/object
     Terminal B: # echo firmware.bin > /sys/bus/i2c/devices/<dev>/update_fw

  2. Device unbind race condition (requires root):
     Terminal A: # cat /sys/bus/i2c/devices/<dev>/object
     Terminal B: # echo "<dev>" > /sys/bus/i2c/drivers/atmel_mxt_ts/unbind

  3. Physical device removal:
     Reading sysfs while physically removing the touchscreen device

How to fix:
Add NULL checks for data->info and data->object_table at the beginning
of mxt_object_show() to prevent NULL pointer dereference when these
resources are freed during concurrent firmware update or device removal.

Fixes: 4cf51c383d7a ("Input: Add ATMEL QT602240 touchscreen driver")
Fixes: 068bdb67ef74 ("Input: atmel_mxt_ts - fix the firmware update")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
 drivers/input/touchscreen/atmel_mxt_ts.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c
b/drivers/input/touchscreen/atmel_mxt_ts.c
index dd0544cc1bc1..401fcae2264d 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -2859,6 +2859,10 @@ static ssize_t mxt_object_show(struct device *dev,
  int error;
  u8 *obuf;

+ /* Check for NULL to prevent race condition during firmware update */
+ if (!data->info || !data->object_table)
+   return -ENODEV;
+
  /* Pre-allocate buffer large enough to hold max sized object. */
  obuf = kmalloc(256, GFP_KERNEL);
  if (!obuf)
-- 
2.34.1

Hi,

On Thu, Jan 15, 2026 at 03:43:37AM +0800, 齐柯宇 wrote:
> diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c
> b/drivers/input/touchscreen/atmel_mxt_ts.c
> index dd0544cc1bc1..401fcae2264d 100644
> --- a/drivers/input/touchscreen/atmel_mxt_ts.c
> +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
> @@ -2859,6 +2859,10 @@ static ssize_t mxt_object_show(struct device *dev,
>   int error;
>   u8 *obuf;
> 
> + /* Check for NULL to prevent race condition during firmware update */
> + if (!data->info || !data->object_table)
> +   return -ENODEV;
> +

What stops the pointers from being invalidated right here?

>   /* Pre-allocate buffer large enough to hold max sized object. */
>   obuf = kmalloc(256, GFP_KERNEL);
>   if (!obuf)

Thanks.

-- 
Dmitry

Hi Dmitry,

Thank you for the review.

You're absolutely right. The NULL check only narrows the race window but
does not eliminate the race condition - the pointers can still be
invalidated between the check and the actual dereference.

I will rework the patch with proper synchronization to fully address this
issue.

regards,

Kery

Dmitry Torokhov <dmitry.torokhov@gmail.com> 于2026年1月21日周三 02:22写道：

>
> Hi,
>
> On Thu, Jan 15, 2026 at 03:43:37AM +0800, 齐柯宇 wrote:
> > diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c
> > b/drivers/input/touchscreen/atmel_mxt_ts.c
> > index dd0544cc1bc1..401fcae2264d 100644
> > --- a/drivers/input/touchscreen/atmel_mxt_ts.c
> > +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
> > @@ -2859,6 +2859,10 @@ static ssize_t mxt_object_show(struct device *dev,
> >   int error;
> >   u8 *obuf;
> >
> > + /* Check for NULL to prevent race condition during firmware update */
> > + if (!data->info || !data->object_table)
> > +   return -ENODEV;
> > +
>
> What stops the pointers from being invalidated right here?
>
> >   /* Pre-allocate buffer large enough to hold max sized object. */
> >   obuf = kmalloc(256, GFP_KERNEL);
> >   if (!obuf)
>
> Thanks.
>
> --
> Dmitry