Input: mtk-pmic-keys - fix possible null pointer dereference

JIRA: https://issues.redhat.com/browse/RHEL-101770
CVE: CVE-2025-37972
Upstream Status: since v6.15
Tested: with the hid-tools test suite and some hardware

commit 11cdb50
Author: Gary Bisson <bisson.gary@gmail.com>
Date:   Tue Apr 29 09:16:29 2025 -0700

    Input: mtk-pmic-keys - fix possible null pointer dereference

    In mtk_pmic_keys_probe, the regs parameter is only set if the button is
    parsed in the device tree. However, on hardware where the button is left
    floating, that node will most likely be removed not to enable that
    input. In that case the code will try to dereference a null pointer.

    Let's use the regs struct instead as it is defined for all supported
    platforms. Note that it is ok setting the key reg even if that latter is
    disabled as the interrupt won't be enabled anyway.

    Fixes: b581acb ("Input: mtk-pmic-keys - transfer per-key bit in mtk_pmic_keys_regs")
    Signed-off-by: Gary Bisson <bisson.gary@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

Author: bentiss

drivers/input/keyboard/mtk-pmic-keys.c

@@ -147,8 +147,8 @@ static void mtk_pmic_keys_lp_reset_setup(struct mtk_pmic_keys *keys,
 	u32 value, mask;
 	int error;
 
-	kregs_home = keys->keys[MTK_PMIC_HOMEKEY_INDEX].regs;
-	kregs_pwr = keys->keys[MTK_PMIC_PWRKEY_INDEX].regs;
+	kregs_home = &regs->keys_regs[MTK_PMIC_HOMEKEY_INDEX];
+	kregs_pwr = &regs->keys_regs[MTK_PMIC_PWRKEY_INDEX];
 
 	error = of_property_read_u32(keys->dev->of_node, "power-off-time-sec",
 				     &long_press_debounce);