Linux rmi4 F54 worker error propagation fix: OOB access analysis

Summary of Key Vulnerability Information Vulnerability Overview Title: Input: synaptics-rmi4 - propagate F54 worker errors to v02 queue Commit: commit Problem Description: Previously, the rmi4 buffer queue would wait for the worker thread to complete but did not check for success. If the worker failed (e.g., due to a timeout or register read failure), the worker thread would silently return success, leading to out-of-bounds access when posting data to the v02 buffer queue or when initializing memory. Fix: Added a field to to store the worker's exit status; in the buffer queue, this field is checked, and if it equals , the error is reported. Scope: The file in the Linux kernel. Fix Commit: ([media] Input: synaptics-rmi4 - add support for F54 diagnostics) POC / Fix Code ```c diff --git a/drivers/input/rmi4/rmi4_f54.c b/drivers/input/rmi4/rmi4_f54.c index 3654603d32d..4e464c479032 100644 --- a/drivers/input/rmi4/rmi4_f54.c +++ b/drivers/input/rmi4/rmi4_f54.c @@ -106,9 @@ struct f54_data { u8 report_data; int report_size; int report_error; struct mutex status_mutex; bool is_busy; mutex_lock(f54->data_mutex); @@ -340,6 +341,12 @@ static void rmi4_f54_buffer_queue(struct rmi4_device *rmi4_f54_data) if (!report_error) { if (f54->rmi4_f54->dev, "Error acquiring report: 0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring frame ptr1:0x%02x", f54->report_error); if (f54->rmi4_f54->dev, "Error acquiring fra

Goal Reached Thanks to every supporter — we hit 100%!

Linux rmi4 F54 worker error propagation fix: OOB access analysis