[PATCH] Input: mms114 - fix touch slot corruption in suspend

[PATCH] Input: mms114 - fix touch slot corruption in suspend

[Dmitry Torokhov]

In mms114_suspend, the driver synthesizes touch release events for all
slots and calls input_sync before disabling the hardware interrupt via
mms114_stop. Because the threaded interrupt handler runs independently
and does not share a lock with this early part of the suspend path, an
incoming hardware interrupt can fire after input_sync completes but
before disable_irq is invoked.

If a touch event arrives during this window, the interrupt handler
reports the touch slot as active again, overwriting the synthetic
release event right before the system goes to sleep. Upon resume,
lifting the finger does not generate a release interrupt, potentially
leaving userspace with a stuck active touch slot.

Fix this race by calling mms114_stop, which disables the IRQ and
synchronizes with any executing interrupt handler, before synthesizing
the touch release events. Also ensure that we only synthesize touch
release events if the input device is enabled, keeping the entire
suspend sequence protected by input_dev->mutex.

Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/input/touchscreen/mms114.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
index 27911a9f4e9e..734c37579f5a 100644
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -679,6 +679,13 @@ static int mms114_suspend(struct device *dev)
 	struct input_dev *input_dev = data->input_dev;
 	int id;
 
+	guard(mutex)(&input_dev->mutex);
+
+	if (!input_device_enabled(input_dev))
+		return 0;
+
+	mms114_stop(data);
+
 	/* Release all touch */
 	for (id = 0; id < MMS114_MAX_TOUCH; id++) {
 		input_mt_slot(input_dev, id);
@@ -688,11 +695,6 @@ static int mms114_suspend(struct device *dev)
 	input_mt_report_pointer_emulation(input_dev, true);
 	input_sync(input_dev);
 
-	guard(mutex)(&input_dev->mutex);
-
-	if (input_device_enabled(input_dev))
-		mms114_stop(data);
-
 	return 0;
 }
 
-- 
2.55.0.571.g244d577d93-goog


-- 
Dmitry