From 9ff1631fd3910b7c8ceb2f304cc410ba5ae7bcae Mon Sep 17 00:00:00 2001 From: Andrew Chant Date: Wed, 14 Sep 2016 15:25:23 -0700 Subject: [PATCH] input: synaptics: defer sysfs creation during init sysfs entries are created which reference fwu->fwu_work. defer the creation of these sysfs entries until the end of the init function, after fwu->fwu_work has been initialized. Change-Id: Ib7d5304ec2990454486e2b1d28b640a174c83d12 Bug: 31252388 Signed-off-by: Andrew Chant CVE-2016-6745 Signed-off-by: Kevin F. Haggerty --- .../input/touchscreen/synaptics_fw_update.c | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/drivers/input/touchscreen/synaptics_fw_update.c b/drivers/input/touchscreen/synaptics_fw_update.c index 5ff2ef69fc1..c506f6ba3ae 100644 --- a/drivers/input/touchscreen/synaptics_fw_update.c +++ b/drivers/input/touchscreen/synaptics_fw_update.c @@ -2263,7 +2263,23 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) fwu->initialized = true; fwu->polling_mode = false; - retval = sysfs_create_bin_file(&rmi4_data->i2c_client->dev.kobj, + fwu->ts_info = kzalloc(RMI4_INFO_MAX_LEN, GFP_KERNEL); + if (!fwu->ts_info) { + dev_err(&rmi4_data->i2c_client->dev, "Not enough memory\n"); + goto exit_free_ts_info; + } + + synaptics_rmi4_update_debug_info(); + +#ifdef INSIDE_FIRMWARE_UPDATE + fwu->fwu_workqueue = create_singlethread_workqueue("fwu_workqueue"); + INIT_DELAYED_WORK(&fwu->fwu_work, synaptics_rmi4_fwu_work); + queue_delayed_work(fwu->fwu_workqueue, + &fwu->fwu_work, + msecs_to_jiffies(1000)); +#endif + + retval = sysfs_create_bin_file(&rmi4_data->i2c_client->dev.kobj, &dev_attr_data); if (retval < 0) { dev_err(&rmi4_data->i2c_client->dev, @@ -2295,22 +2311,6 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) goto exit_remove_attrs; } - fwu->ts_info = kzalloc(RMI4_INFO_MAX_LEN, GFP_KERNEL); - if (!fwu->ts_info) { - dev_err(&rmi4_data->i2c_client->dev, "Not enough memory\n"); - goto exit_free_ts_info; - } - - synaptics_rmi4_update_debug_info(); - -#ifdef INSIDE_FIRMWARE_UPDATE - fwu->fwu_workqueue = create_singlethread_workqueue("fwu_workqueue"); - INIT_DELAYED_WORK(&fwu->fwu_work, synaptics_rmi4_fwu_work); - queue_delayed_work(fwu->fwu_workqueue, - &fwu->fwu_work, - msecs_to_jiffies(1000)); -#endif - return 0; exit_free_ts_info: debugfs_remove(temp);