commit e58c88f0cb2d8ed89de78f6f17409d29cfab6c5c upstream.

lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work
handler lkkbd_reinit() dereferences the lkkbd structure and its
serio/input_dev fields.

lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd
structure without preventing the reinit work from being queued again
until serio_close() returns. This can allow the work handler to run
after the structure has been freed, leading to a potential use-after-free.

Use disable_work_sync() instead of cancel_work_sync() to ensure the
reinit work cannot be re-queued, and call it both in lkkbd_disconnect()
and in lkkbd_connect() error paths after serio_open().

Signed-off-by: Minseong Kim <ii4gsp@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251212052314.16139-1-ii4gsp@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sync up with the mainline to bring in definition of
INPUT_PROP_HAPTIC_TOUCHPAD.

If cros_ec_keyb_register_matrix() isn't called (due to
`buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains
NULL.  An invalid memory access is observed in cros_ec_keyb_process()
when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work()
in such case.

  Unable to handle kernel read from unreadable memory at virtual address 0000000000000028
  ...
  x3 : 0000000000000000 x2 : 0000000000000000
  x1 : 0000000000000000 x0 : 0000000000000000
  Call trace:
  input_event
  cros_ec_keyb_work
  blocking_notifier_call_chain
  ec_irq_thread

It's still unknown about why the kernel receives such malformed event,
in any cases, the kernel shouldn't access `ckdev->idev` and friends if
the driver doesn't intend to initialize them.

Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://patch.msgid.link/20251104070310.3212712-1-tzungbi@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This is supposed to be "priv" but we accidentally pass "&priv" which is
an address in the stack and so it will lead to memory corruption when
the imx_sc_key_action() function is called.  Remove the &.

Fixes: 768062fd1284 ("Input: imx_sc_key - use devm_add_action_or_reset() to handle all cleanups")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/aQYKR75r2VMFJutT@stanley.mountain
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull input updates from Dmitry Torokhov:

 - Conversions to yaml/json schema and fixes for input-related device
   tree bindings

 - New drivers:
     - Awinic AW86927 haptic chip
     - Hynitron CST816x series controller
     - Himax HX852x(ES) touchscreen controller

 - Fix uinput to not leak kernel memory via a gap in
   uinput_ff_upload_compat structure

 - Prevent overflow in pressure calculation in tsc2007 driver causing
   phantom touches

 - Make the Atmel maxTouch driver support generic touchscreen
   configuration (flip, rotate, etc)

 - Drop support for platform data in tca8418_keypad, pxa27x-keypad,
   spear-keyboard and twl4030_keypad drivers, they all now rely on
   generic device properties for configuration

 - Other assorted changes and fixes

* tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (50 commits)
  Input: atmel_mxt_ts - allow reset GPIO to sleep
  Input: aw86927 - fix error code in probe()
  Input: psxpad-spi - add a check for the return value of spi_setup()
  Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
  Input: aw86927 - add driver for Awinic AW86927
  dt-bindings: input: Add Awinic AW86927
  dt-bindings: touchscreen: remove touchscreen.txt
  dt-bindings: arm: bcm: raspberrypi,bcm2835-firmware: Add touchscreen child node
  dt-bindings: touchscreen: convert eeti bindings to json schema
  Input: pm8941-pwrkey - disable wakeup for resin by default
  dt-bindings: input: pm8941-pwrkey: Document wakeup-source property
  Input: add driver for Hynitron CST816x series
  dt-bindings: input: touchscreen: add hynitron cst816x series
  Input: imx6ul_tsc - set glitch threshold by DTS property
  dt-bindings: touchscreen: fsl,imx6ul-tsc: support glitch thresold
  dt-bindings: touchscreen: add debounce-delay-us property
  Input: ps2-gpio - fix typo
  Input: atmel_mxt_ts - add support for generic touchscreen configurations
  dt-bindings: input: maxtouch: add common touchscreen properties
  dt-bindings: touchscreen: convert zet6223 bindings to json schema
  ...

Prepare input updates for 6.18 merge window.

Pull gpio updates from Bartosz Golaszewski:
 "There are two new drivers and support for more models in existing
  ones.

  The generic GPIO API has been reworked and all users converted
  which allowed us to move the fields specific to the generic GPIO
  implementation out of the high-level struct gpio_chip into its own
  structure that wraps the gpio_chip.

  Other than that, there's nothing too exciting. Mostly minor tweaks and
  fixes all over the place, some refactoring and some small new features
  in helper modules.

  GPIO core:
   - add support for sparse pin ranges to the glue between GPIO and
     pinctrl
   - use a common prefix across all GPIO descriptor flags for improved
     namespacing

  New drivers:
   - add new GPIO driver for the Nuvoton NCT6694
   - add new GPIO driver for MAX7360

  Driver improvements:
   - add support for Tegra 256 to the gpio-tegra186 driver
   - add support for Loongson-2K0300 to the gpio-loongson-64bit driver
   - refactor the gpio-aggregator module to expose its GPIO forwarder
     API to other in-kernel users (to enable merging of a new pinctrl
     driver that uses it)
   - convert all remaining drivers to using the modernized generic GPIO
     chip API and remove the old interface
   - stop displaying global GPIO numbers in debugfs output of controller
     drivers
   - extend the gpio-regmap helper with a new config option and improve
     its support for GPIO interrupts
   - remove redundant fast_io parameter from regmap configs in GPIO
     drivers that already use MMIO regmaps which imply it
   - add support for a new model in gpio-mmio: ixp4xx expansion bus
   - order includes alphabetically in a few drivers for better
     readability
   - use generic device properties where applicable
   - use devm_mutex_init() where applicable
   - extend build coverage of drivers by enabling more to be compiled
     with COMPILE_TEST enabled
   - allow building gpio-stmpe as a module
   - use dev_err_probe() where it makes sense in drivers

  Late driver fixes:
   - fix setting GPIO direction to output in gpio-mpfs

  Documentation:
   - document the usage of software nodes with GPIO chips

  Device-tree bindings:
   - Add DT bindings documents for new hardware: Tegra256, MAX7360
   - Document a new model in Loongson bindings: LS2K0300
   - Document a new model using the generic GPIO binding: IXP4xx
   - Convert the DT binding for fsl,mxs-pinctrl to YAML
   - fix the schema ID in the "trivial" GPIO schema
   - describe GPIO hogs in the generic GPIO binding"

* tag 'gpio-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (122 commits)
  gpio: mpfs: fix setting gpio direction to output
  gpio: generic: move GPIO_GENERIC_ flags to the correct header
  gpio: generic: rename BGPIOF_ flags to GPIO_GENERIC_
  gpio: nomadik: fix the debugfs helper stub
  MAINTAINERS: Add entry on MAX7360 driver
  input: misc: Add support for MAX7360 rotary
  input: keyboard: Add support for MAX7360 keypad
  gpio: max7360: Add MAX7360 gpio support
  gpio: regmap: Allow to provide init_valid_mask callback
  gpio: regmap: Allow to allocate regmap-irq device
  pwm: max7360: Add MAX7360 PWM support
  pinctrl: Add MAX7360 pinctrl driver
  mfd: Add max7360 support
  dt-bindings: mfd: gpio: Add MAX7360
  rtc: Add Nuvoton NCT6694 RTC support
  hwmon: Add Nuvoton NCT6694 HWMON support
  watchdog: Add Nuvoton NCT6694 WDT support
  can: Add Nuvoton NCT6694 CANFD support
  i2c: Add Nuvoton NCT6694 I2C support
  gpio: Add Nuvoton NCT6694 GPIO support
  ...

Pull chrome platform updates from Tzung-Bi Shih:
 "New:
   - Add a new API cros_ec_device_registered() for checking if the
     cros_ec_deivce is ready

  Improvements:
   - Use TRAILING_OVERLAP() to fix -Wflex-array-member-not-at-end
     warning
   - Defer probe until parent EC device is ready in cros_ec_keyb

  Cleanups:
   - Remove redundant and simplify code in cros_ec_chardev
   - Centralize cros_ec_device allocation and initialization to remove
     duplicate code"

* tag 'chrome-platform-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
  Input: cros_ec_keyb - Defer probe until parent EC device is registered
  platform/chrome: cros_ec: Add a flag to track registration state
  platform/chrome: cros_ec: Separate initialization from cros_ec_register()
  platform/chrome: Centralize common cros_ec_device initialization
  platform/chrome: Centralize cros_ec_device allocation
  platform/chrome: wilco_ec: Remove redundant semicolons
  platform/chrome: cros_ec: Avoid -Wflex-array-member-not-at-end warning
  platform/chrome: cros_ec_chardev: Decouple fops from struct cros_ec_dev
  platform/chrome: cros_ec_chardev: Remove redundant struct field

Support for platform data from dropped from twl in 4a346a03a63c ("mfd:
twl: Remove platform data support") and board files were dropped even
earlier. There are no in-kernel users of twl4030_keypad_data in the
kernel, and the driver supports configuration via generic device
properties.

Drop support of static platform data from the keypad driver.

Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://lore.kernel.org/r/tica7ol7xwv5tqb7hlkzu6wkiv4quxwrpqv6croe4wfnwvj6wv@4ob6ktqqi3cr
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Sync up with MFD tree to bring in support for MAX7360.