Re: [PATCH v8 4/5] Input: stmfts - support FTS5

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] input: missing ABS_MT_TOOL_TYPE capability breaks stylus/palm reporting
- [Medium] input: missing NULL check for i2c_get_match_data() in probe
--

commit 997befb9927821c565f6d2664205f5c6f9c83d19
Author: David Heidelberg <david@ixit.cz>

Input: stmfts - support FTS5

This commit adds FTS5 support to the STMicroelectronics FTS Touchscreen
driver. It introduces a mode-switch GPIO and device-specific ops to handle
FTS4 and FTS5 variations.

> diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
> index 1720202d6186b..2b9faeef7e462 100644
> --- a/drivers/input/touchscreen/stmfts.c
> +++ b/drivers/input/touchscreen/stmfts.c
[ ... ]
> @@ -656,6 +882,50 @@ static void stmfts_power_off(void *data)
>  	regulator_bulk_disable(ARRAY_SIZE(stmfts_supplies), sdata->supplies);
>  }
>  
[ ... ]
> +static int stmfts5_setup_input(struct stmfts_data *sdata)
> +{
> +	struct device *dev = &sdata->client->dev;
> +
> +	sdata->mode_switch_gpio = devm_gpiod_get_optional(dev, "mode-switch",
> +							  GPIOD_OUT_HIGH);
> +	if (IS_ERR(sdata->mode_switch_gpio))
> +		return dev_err_probe(dev, PTR_ERR(sdata->mode_switch_gpio),
> +				     "Failed to get GPIO 'switch'\n");
> +
> +	/* Set resolution for accurate calibration */
> +	if (!input_abs_get_res(sdata->input, ABS_MT_POSITION_X)) {
> +		input_abs_set_res(sdata->input, ABS_MT_POSITION_X, 10);
> +		input_abs_set_res(sdata->input, ABS_MT_POSITION_Y, 10);
> +	}
> +
> +	input_set_abs_params(sdata->input, ABS_MT_DISTANCE, 0, 255, 0, 0);
> +
> +	/* Enable stylus support if requested */
> +	sdata->stylus_enabled = device_property_read_bool(dev, "stylus-enabled");
> +
> +	return input_mt_init_slots(sdata->input, STMFTS_MAX_FINGERS,
> +				   INPUT_MT_DIRECT);

[Severity: Medium]
Will this break stylus and palm reporting?

In stmfts5_setup_input(), the driver configures absolute axes but omits calling
input_set_abs_params() for ABS_MT_TOOL_TYPE.

Later, when stmfts5_report_contact_event() attempts to report MT_TOOL_PEN or
MT_TOOL_PALM using input_mt_report_slot_state(), won't the input core discard
these tool type events because ABS_MT_TOOL_TYPE is missing from dev->absbit?

> +}
> +
[ ... ]
> @@ -701,6 +971,8 @@ static int stmfts_probe(struct i2c_client *client)
>  	mutex_init(&sdata->mutex);
>  	init_completion(&sdata->cmd_done);
>  
> +	sdata->ops = i2c_get_match_data(client);
> +

[Severity: Medium]
Is it possible for i2c_get_match_data() to return NULL here if the driver is
bound to an I2C device via sysfs using the driver_override attribute?

>  	err = devm_regulator_bulk_get_const(dev,
>  					    ARRAY_SIZE(stmfts_supplies),
>  					    stmfts_supplies,
> @@ -728,18 +1000,9 @@ static int stmfts_probe(struct i2c_client *client)
>  
>  	input_set_abs_params(sdata->input, ABS_MT_TOUCH_MAJOR, 0, 255, 0, 0);
>  	input_set_abs_params(sdata->input, ABS_MT_TOUCH_MINOR, 0, 255, 0, 0);
> -	input_set_abs_params(sdata->input, ABS_MT_ORIENTATION, 0, 255, 0, 0);
>  	input_set_abs_params(sdata->input, ABS_MT_PRESSURE, 0, 255, 0, 0);
> -	input_set_abs_params(sdata->input, ABS_DISTANCE, 0, 255, 0, 0);
>  
> -	sdata->use_key = device_property_read_bool(dev, "touch-key-connected");
> -	if (sdata->use_key) {
> -		input_set_capability(sdata->input, EV_KEY, KEY_MENU);
> -		input_set_capability(sdata->input, EV_KEY, KEY_BACK);
> -	}
> -
> -	err = input_mt_init_slots(sdata->input,
> -				  STMFTS_MAX_FINGERS, INPUT_MT_DIRECT);
> +	err = sdata->ops->setup_input(sdata);

[Severity: Medium]
If i2c_get_match_data() returned NULL above, will this result in a NULL
pointer dereference?

>  	if (err)
>  		return err;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925-stmfts5-v8-0-0fcf49e2c85f@ixit.cz?part=4