[lvc-project] [PATCH 5.10/5.15/6.1] HID: mcp2221: Set driver data before I2C adapter add

[Mikhail Lobanov]

From: Hamish Martin <hamish.martin at alliedtelesis.co.nz>

commit f2d4a5834638bbc967371b9168c0b481519f7c5e upstream.

The process of adding an I2C adapter can invoke I2C accesses on that new
adapter (see i2c_detect()).

Ensure we have set the adapter's driver data to avoid null pointer
dereferences in the xfer functions during the adapter add.

This has been noted in the past and the same fix proposed but not
completed. See:
https://lore.kernel.org/lkml/ef597e73-ed71-168e-52af-0d19b03734ac@vigem.de/

Signed-off-by: Hamish Martin <hamish.martin at alliedtelesis.co.nz>
Signed-off-by: Jiri Kosina <jkosina at suse.cz>
[Mikhail Lobanov: older kernels use i2c_add_adapter() instead of
devm_i2c_add_adapter().
This problem manifests itself in stable kernel branches:
https://syzkaller.appspot.com/bug?extid=40dc62a33c759a65ad44,
https://syzkaller.appspot.com/bug?extid=24b122f8e84c3f9d9d1d]
Signed-off-by: Mikhail Lobanov <m.lobanov at rosa.ru>
---
 drivers/hid/hid-mcp2221.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c
index 560eeec4035a..b0dc0edc69c2 100644
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -879,12 +879,12 @@ static int mcp2221_probe(struct hid_device *hdev,
 	snprintf(mcp->adapter.name, sizeof(mcp->adapter.name),
 			"MCP2221 usb-i2c bridge");
 
+	i2c_set_adapdata(&mcp->adapter, mcp);
 	ret = i2c_add_adapter(&mcp->adapter);
 	if (ret) {
 		hid_err(hdev, "can't add usb-i2c adapter: %d\n", ret);
 		goto err_i2c;
 	}
-	i2c_set_adapdata(&mcp->adapter, mcp);
 
 	/* Setup GPIO chip */
 	mcp->gc = devm_kzalloc(&hdev->dev, sizeof(*mcp->gc), GFP_KERNEL);
-- 
2.47.2