diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-08-04 20:46:31 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-10-09 22:55:36 -0700 |
| commit | 68a0deade76c01da05f434df9094c2d4cefce1ef (patch) | |
| tree | 5fcb58afdd1b11f7cd5c31dec7fa7648cb7dfe29 /drivers | |
| parent | 8a1a516e8ee68a0c99bd46eec1cc052637bd4670 (diff) | |
Input: mms114 - fix touch slot corruption in suspend
In mms114_suspend, the driver synthesizes touch release events for all
slots and calls input_sync before disabling the hardware interrupt via
mms114_stop. Because the threaded interrupt handler runs independently
and does not share a lock with this early part of the suspend path, an
incoming hardware interrupt can fire after input_sync completes but
before disable_irq is invoked.
If a touch event arrives during this window, the interrupt handler
reports the touch slot as active again, overwriting the synthetic
release event right before the system goes to sleep. Upon resume,
lifting the finger does not generate a release interrupt, potentially
leaving userspace with a stuck active touch slot.
Fix this race by calling mms114_stop, which disables the IRQ and
synchronizes with any executing interrupt handler, before synthesizing
the touch release events. Also ensure that we only synthesize touch
release events if the input device is enabled, keeping the entire
suspend sequence protected by input_dev->mutex.
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.6-flash
Link: https://patch.msgid.link/anKxGkyRRu5A92Q_@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/input/touchscreen/mms114.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c index 47f51365003b..f6039a47f7e9 100644 --- a/drivers/input/touchscreen/mms114.c +++ b/drivers/input/touchscreen/mms114.c @@ -678,6 +678,13 @@ static int mms114_suspend(struct device *dev) struct input_dev *input_dev = data->input_dev; int id; + guard(mutex)(&input_dev->mutex); + + if (!input_device_enabled(input_dev)) + return 0; + + mms114_stop(data); + /* Release all touch */ for (id = 0; id < MMS114_MAX_TOUCH; id++) { input_mt_slot(input_dev, id); @@ -687,11 +694,6 @@ static int mms114_suspend(struct device *dev) input_mt_report_pointer_emulation(input_dev, true); input_sync(input_dev); - guard(mutex)(&input_dev->mutex); - - if (input_device_enabled(input_dev)) - mms114_stop(data); - return 0; } |