[PATCH v3 0/5] Input: applespi - Fix probe timeout and use-after-free bugs

[Shih-Yuan Lee <fourdollars@debian.org>]

This 5-patch series refactors the applespi driver for Apple SPI keyboards and touchpads,
eliminating use-after-free (UAF) race conditions during driver unbind, kernel panics
in debugfs, level-triggered ACPI GPE interrupt storms, and data races.

Specifically, this series:
  - Replaces separate drain helpers with a unified wait queue and 3-second timeout barrier,
    falling back to unconditional completion waiting if transfers remain active to prevent
    premature driver unbind and DMA memory corruption.
  - Tracks in-flight asynchronous SPI transfers using a completion tracking array and
    cancel_spi flag, ensuring inner completion callbacks execute prior to waking wait
    queue waiters to guarantee teardown safety.
  - Converts touchpad detection and registration from an asynchronous workqueue worker
    to a synchronous probe sequence, while protecting against NULL pointer dereferences in
    debugfs during keyboard-only fallback mode.
  - Corrects driver unbind sequence by disabling ACPI GPE handlers before marking the driver
    as shutting down, avoiding level-triggered interrupt storms on unhandled reads.

Changes in v3:
  - Addressed feedback from Sashiko review on the v2 patchset:
  - Fixed Use-After-Free in applespi_drain_writes() and applespi_drain_reads()
    on timeout by falling back to unconditional wait (wait_event_lock_irq()) if
    transfers are still active upon 3-second timeout expiry.
  - Activated cancel_spi tracking flag by setting cancel_spi = true in drain functions
    under cmd_msg_lock to reject new async requests (-ESHUTDOWN) and trigger wait
    queue wakeups.
  - Fixed completion callback race in applespi_async_complete() by invoking inner
    complete(applespi) callback BEFORE clearing tracking slot and waking waiters
    on wait_queue.
  - Fixed NULL pointer dereference in applespi_tp_dim_open() when touchpad registration
    fails or times out, returning -ENODEV if touchpad_input_dev is NULL.
  - Protected rcvd_tp_info from data races in probe by making a safe local copy under
    cmd_msg_lock before passing to applespi_register_touchpad_device().
  - Fixed GPE Interrupt Storm during unbind in applespi_remove() by disabling and
    removing GPE handler BEFORE setting cancel_spi = true and waiting for transfers to drain.

Changes since v1:
  - Split the large touchpad registration patch into 4 distinct, single-purpose
    commits (wait queue consolidation & timeouts, async queue slots tracking,
    synchronous registration, and async probe preference) for better readability.
  - Fixed a self-deadlock in applespi_async() where it attempted to acquire
    cmd_msg_lock while already held by applespi_notify() and other callers.
  - Updated applespi_async() to assert the lock is held by the caller.
  - Protected touchpad info flags under cmd_msg_lock in response handling.
  - Simplified applespi_tp_dim_open() by removing redundant NULL checks.
  - Overhauled GPE disabling and teardown order in applespi_remove() to prevent
    GPE interrupt storms and unbind deadlocks.
  - Addressed reviewer feedback from Sashiko.

Shih-Yuan Lee (5):
  Input: applespi - use unified wait queue with timeouts for drain
  Input: applespi - track asynchronous SPI transfers in flight
  Input: applespi - register touchpad synchronously in probe
  Input: applespi - prefer asynchronous driver probing
  Input: applespi - fix use-after-free in applespi_remove()

 drivers/input/keyboard/applespi.c | 208 +++++++++++++++++++++++++-----
 1 file changed, 175 insertions(+), 33 deletions(-)

-- 
2.39.5