[PATCH] Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound

[PATCH] Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound

[Dmitry Torokhov]

Transport drivers (such as rmi_i2c and rmi_spi) invoke
rmi_driver_suspend() and rmi_driver_resume() on their child rmi_dev
device during system power management events. However, transport drivers
are fully registered and operational even if the physical RMI driver
failed to bind or probe the rmi_dev device.

When rmi_driver_suspend() or rmi_driver_resume() is called on an unbound
rmi_dev, dev_get_drvdata() returns NULL. Calling rmi_disable_irq() or
rmi_enable_irq() without driver data attached causes a NULL pointer
dereference and General Protection Fault when attempting to lock
data->enabled_mutex.

Fix this by checking if driver data is attached to rmi_dev in
rmi_driver_suspend() and rmi_driver_resume(), exiting early if
no driver data is present.

Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Reported-by: syzbot+09103639e39c989e3ed3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=09103639e39c989e3ed3
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/input/rmi4/rmi_driver.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 5d49a9021c7d..a349dfd17519 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -991,6 +991,15 @@ int rmi_driver_suspend(struct rmi_device *rmi_dev, bool enable_wake)
 {
 	int retval;
 
+	/*
+	 * Transport driver will try to suspend RMI device even if physical
+	 * driver did not bind to the RMI device, because transport device
+	 * (I2C, SPI) is fully registered and operational. Exit early if
+	 * there is no driver data attached to the RMI device.
+	 */
+	if (!dev_get_drvdata(&rmi_dev->dev))
+		return 0;
+
 	retval = rmi_suspend_functions(rmi_dev);
 	if (retval)
 		dev_warn(&rmi_dev->dev, "Failed to suspend functions: %d\n",
@@ -1005,6 +1014,10 @@ int rmi_driver_resume(struct rmi_device *rmi_dev, bool clear_wake)
 {
 	int retval;
 
+	/* Skip if not fully bound to RMI driver */
+	if (!dev_get_drvdata(&rmi_dev->dev))
+		return 0;
+
 	rmi_enable_irq(rmi_dev, clear_wake);
 
 	retval = rmi_resume_functions(rmi_dev);
-- 
2.55.0.679.g6767b8d81c-goog


-- 
Dmitry

Re: [PATCH] Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound

[Dmitry Torokhov]

On Wed, Aug 05, 2026 at 10:44:23PM -0700, Dmitry Torokhov wrote:
> Transport drivers (such as rmi_i2c and rmi_spi) invoke
> rmi_driver_suspend() and rmi_driver_resume() on their child rmi_dev
> device during system power management events. However, transport drivers
> are fully registered and operational even if the physical RMI driver
> failed to bind or probe the rmi_dev device.
> 
> When rmi_driver_suspend() or rmi_driver_resume() is called on an unbound
> rmi_dev, dev_get_drvdata() returns NULL. Calling rmi_disable_irq() or
> rmi_enable_irq() without driver data attached causes a NULL pointer
> dereference and General Protection Fault when attempting to lock
> data->enabled_mutex.
> 
> Fix this by checking if driver data is attached to rmi_dev in
> rmi_driver_suspend() and rmi_driver_resume(), exiting early if
> no driver data is present.

Note that better fix would be to have RMI driver implement PM methods
(suspend, resume) but that requires more careful planning, especially
around RMI-HID.

Thanks.

-- 
Dmitry