From 29be646f75c4406bdd8322572a6054ebd22bf63b Mon Sep 17 00:00:00 2001 From: Sebastian Reichel Date: Wed, 19 Nov 2025 01:41:40 +0100 Subject: [PATCH 1/3] platform: arm64: thinkpad-t14s-ec: fix IRQ race condition MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix a race condition, that an input key related interrupt might be triggered before the input handler has been registered, which results in a NULL pointer dereference. This can happen if the user enables the keyboard backlight shortly before the driver is being probed. This fixes the following backtrace visible in dmesg: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e0 ... Call trace: sparse_keymap_report_event+0x2c/0x978 [sparse_keymap] (P) t14s_ec_irq_handler+0x190/0x3e8 [lenovo_thinkpad_t14s] irq_thread_fn+0x30/0xb8 irq_thread+0x18c/0x3b0 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Fixes: 60b7ab6ce030 ("platform: arm64: thinkpad-t14s-ec: new driver") Signed-off-by: Sebastian Reichel Reviewed-by: Bryan O'Donoghue Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-1-441219857c02@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen --- drivers/platform/arm64/lenovo-thinkpad-t14s.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/platform/arm64/lenovo-thinkpad-t14s.c b/drivers/platform/arm64/lenovo-thinkpad-t14s.c index 1d5d11adaf32..c1c01b977f2b 100644 --- a/drivers/platform/arm64/lenovo-thinkpad-t14s.c +++ b/drivers/platform/arm64/lenovo-thinkpad-t14s.c @@ -557,12 +557,6 @@ static int t14s_ec_probe(struct i2c_client *client) return dev_err_probe(dev, PTR_ERR(ec->regmap), "Failed to init regmap\n"); - ret = devm_request_threaded_irq(dev, client->irq, NULL, - t14s_ec_irq_handler, - IRQF_ONESHOT, dev_name(dev), ec); - if (ret < 0) - return dev_err_probe(dev, ret, "Failed to get IRQ\n"); - ret = t14s_leds_probe(ec); if (ret < 0) return ret; @@ -579,6 +573,12 @@ static int t14s_ec_probe(struct i2c_client *client) if (ret < 0) return ret; + ret = devm_request_threaded_irq(dev, client->irq, NULL, + t14s_ec_irq_handler, + IRQF_ONESHOT, dev_name(dev), ec); + if (ret < 0) + return dev_err_probe(dev, ret, "Failed to get IRQ\n"); + /* * Disable wakeup support by default, because the driver currently does * not support masking any events and the laptop should not wake up when From 752630cb8c62abca0407f96cc7baa2e13335cd15 Mon Sep 17 00:00:00 2001 From: Sebastian Reichel Date: Wed, 19 Nov 2025 01:41:41 +0100 Subject: [PATCH 2/3] platform: arm64: thinkpad-t14s-ec: sleep after EC access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ACPI ECRD and ECWR functions have a 10ms sleep at the end. It turns out, that this is sometimes needed to avoid I2C transmission failures, especially for functions doing regmap_update_bits (and thus read + write shortly after each other). This fixes problems like the following appearing in the kernel log: leds platform::micmute: Setting an LED's brightness failed (-6) leds platform::kbd_backlight: Setting an LED's brightness failed (-6) The ACPI QEVT function used to read the interrupt status register also has a 10ms sleep at the end. Without that there are problems with reading multiple events following directly after each other resulting in the following error message being logged: thinkpad-t14s-ec 4-0028: Failed to read event Fixes: 60b7ab6ce030 ("platform: arm64: thinkpad-t14s-ec: new driver") Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-2-441219857c02@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen --- drivers/platform/arm64/lenovo-thinkpad-t14s.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/platform/arm64/lenovo-thinkpad-t14s.c b/drivers/platform/arm64/lenovo-thinkpad-t14s.c index c1c01b977f2b..cf6a1d3b2617 100644 --- a/drivers/platform/arm64/lenovo-thinkpad-t14s.c +++ b/drivers/platform/arm64/lenovo-thinkpad-t14s.c @@ -120,6 +120,7 @@ static int t14s_ec_write(void *context, unsigned int reg, if (ret < 0) return ret; + fsleep(10000); return 0; } @@ -157,6 +158,7 @@ static int t14s_ec_read(void *context, unsigned int reg, out: i2c_unlock_bus(client->adapter, I2C_LOCK_SEGMENT); + fsleep(10000); return ret; } @@ -191,6 +193,8 @@ static int t14s_ec_read_evt(struct t14s_ec *ec, u8 *val) if (ret < 0) goto out; + fsleep(10000); + ret = 0; out: From 9b9c0adbc3f8a524d291baccc9d0c04097fb4869 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 21 Nov 2025 20:51:28 +0300 Subject: [PATCH 3/3] platform/x86: intel: punit_ipc: fix memory corruption MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This passes the address of the pointer "&punit_ipcdev" when the intent was to pass the pointer itself "punit_ipcdev" (without the ampersand). This means that the: complete(&ipcdev->cmd_complete); in intel_punit_ioc() will write to a wrong memory address corrupting it. Fixes: fdca4f16f57d ("platform:x86: add Intel P-Unit mailbox IPC driver") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aSCmoBipSQ_tlD-D@stanley.mountain Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen --- drivers/platform/x86/intel/punit_ipc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/x86/intel/punit_ipc.c b/drivers/platform/x86/intel/punit_ipc.c index bafac8aa2baf..14513010daad 100644 --- a/drivers/platform/x86/intel/punit_ipc.c +++ b/drivers/platform/x86/intel/punit_ipc.c @@ -250,7 +250,7 @@ static int intel_punit_ipc_probe(struct platform_device *pdev) } else { ret = devm_request_irq(&pdev->dev, irq, intel_punit_ioc, IRQF_NO_SUSPEND, "intel_punit_ipc", - &punit_ipcdev); + punit_ipcdev); if (ret) { dev_err(&pdev->dev, "Failed to request irq: %d\n", irq); return ret;