Re: [PATCH v3 4/5] Input: applespi - prefer asynchronous driver probing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Concurrent data race on the global `touchpad_dimensions` array due to asynchronous probing.
--

--- Patch [4]: [PATCH v3 4/5] Input: applespi - prefer asynchronous driver probing ---
commit b9f1c9a61a0fcf093f49319a208df622cfeba00e
Author: Shih-Yuan Lee <fourdollars@debian.org>
Input: applespi - prefer asynchronous driver probing

This commit enables asynchronous probing for the applespi driver to avoid
blocking the main kernel thread. It also cleans up product ID retrieval
in applespi_tp_dim_open().

> diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/applespi.c
> --- a/drivers/input/keyboard/applespi.c
> +++ b/drivers/input/keyboard/applespi.c
[ ... ]
> @@ -2044,6 +2045,7 @@ static struct spi_driver applespi_driver = {
>  		.name			= "applespi",
>  		.acpi_match_table	= applespi_acpi_match,
>  		.pm			= pm_sleep_ptr(&applespi_pm_ops),
> +		.probe_type		= PROBE_PREFER_ASYNCHRONOUS,

[Severity: Medium]
Could enabling asynchronous probing here cause a data race on the global
touchpad_dimensions array?

Looking at applespi_register_touchpad_device(), it reads from and modifies
the global touchpad_dimensions module parameter without locking:

drivers/input/keyboard/applespi.c:applespi_register_touchpad_device()
        sts = sscanf(touchpad_dimensions, "%dx%d+%u+%u", &x, &y, &w, &h);
        ...
        touchpad_dimensions[0] = '\0';
        ...
        snprintf(touchpad_dimensions, sizeof(touchpad_dimensions), ...

If a system has multiple instances of the APP000D ACPI device, the driver
core could probe them concurrently, potentially corrupting this string or
causing incorrect dimensions to be read and parsed.

>  	},
>  	.probe		= applespi_probe,
>  	.remove		= applespi_remove,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720162219.32324-1-fourdollars@debian.org?part=4