[PATCH] Input: mms114 - fix touch slot corruption in suspend

[PATCH] Input: mms114 - fix touch slot corruption in suspend

[Dmitry Torokhov]

In mms114_suspend, the driver synthesizes touch release events for all
slots and calls input_sync before disabling the hardware interrupt via
mms114_stop. Because the threaded interrupt handler runs independently
and does not share a lock with this early part of the suspend path, an
incoming hardware interrupt can fire after input_sync completes but
before disable_irq is invoked.

If a touch event arrives during this window, the interrupt handler
reports the touch slot as active again, overwriting the synthetic
release event right before the system goes to sleep. Upon resume,
lifting the finger does not generate a release interrupt, potentially
leaving userspace with a stuck active touch slot.

Fix this race by calling mms114_stop, which disables the IRQ and
synchronizes with any executing interrupt handler, before synthesizing
the touch release events. Also ensure that we only synthesize touch
release events if the input device is enabled, keeping the entire
suspend sequence protected by input_dev->mutex.

Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/input/touchscreen/mms114.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
index 27911a9f4e9e..734c37579f5a 100644
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -679,6 +679,13 @@ static int mms114_suspend(struct device *dev)
 	struct input_dev *input_dev = data->input_dev;
 	int id;
 
+	guard(mutex)(&input_dev->mutex);
+
+	if (!input_device_enabled(input_dev))
+		return 0;
+
+	mms114_stop(data);
+
 	/* Release all touch */
 	for (id = 0; id < MMS114_MAX_TOUCH; id++) {
 		input_mt_slot(input_dev, id);
@@ -688,11 +695,6 @@ static int mms114_suspend(struct device *dev)
 	input_mt_report_pointer_emulation(input_dev, true);
 	input_sync(input_dev);
 
-	guard(mutex)(&input_dev->mutex);
-
-	if (input_device_enabled(input_dev))
-		mms114_stop(data);
-
 	return 0;
 }
 
-- 
2.55.0.571.g244d577d93-goog


-- 
Dmitry

Re: [PATCH] Input: mms114 - fix touch slot corruption in suspend

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Active touchkeys are not released during suspend, potentially causing them to be stuck upon resume.
--

--- Patch [1]: [PATCH] Input: mms114 - fix touch slot corruption in suspend ---
commit 1d29053929170cae6a2ebfa311bed7d55133b74a
Author: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: mms114 - fix touch slot corruption in suspend

This commit fixes a race condition during suspend by disabling the IRQ and
synchronizing with the interrupt handler before synthesizing touch release
events. It also ensures touch release events are only synthesized if the
input device is enabled, protecting the sequence with the input device mutex.

> diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
> index 27911a9f4e9eb..734c37579f5a4 100644
> --- a/drivers/input/touchscreen/mms114.c
> +++ b/drivers/input/touchscreen/mms114.c
> @@ -679,6 +679,13 @@ static int mms114_suspend(struct device *dev)
[ ... ]
> +	mms114_stop(data);
> +
>  	/* Release all touch */
>  	for (id = 0; id < MMS114_MAX_TOUCH; id++) {
>  		input_mt_slot(input_dev, id);
>  		input_mt_report_slot_inactive(input_dev);
>  	}
>  
>  	input_mt_report_pointer_emulation(input_dev, true);
>  	input_sync(input_dev);

[Severity: High]
This is a pre-existing issue, but does this sequence also need to synthesize
release events for active touchkeys?

If a touchkey (such as Back or Menu) is pressed when the device suspends,
mms114_stop() powers down the hardware without sending a hardware release
interrupt. Since this loop only releases multitouch slots, it seems the
touchkey could remain logically stuck in the active state in the input core
upon resume.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/anKxGkyRRu5A92Q_@google.com?part=1