A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

HID: asus: use spinlock to safely schedule workers

Browse source 
commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream.

Use spinlocks to deal with workers introducing a wrapper
asus_schedule_work(), and several spinlock checks.
Otherwise, asus_kbd_backlight_set() may schedule led->work after the
structure has been freed, causing a use-after-free.

Fixes: af22a610bc ("HID: asus: support backlight on USB keyboards")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Pietro Borrello 2023-02-12 19:00:03 +00:00 • committed by Greg Kroah-Hartman
commit dd08e68d04
1 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
drivers/hid/hid-asus.c
View file

@ -347,6 +347,16 @@ static int asus_kbd_get_functions(struct hid_device *hdev,
return ret;
}
static void asus_schedule_work(struct asus_kbd_leds *led)
{
unsigned long flags;
spin_lock_irqsave(&led->lock, flags);
if (!led->removed)
schedule_work(&led->work);
spin_unlock_irqrestore(&led->lock, flags);
}
static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
enum led_brightness brightness)
{
@ -358,7 +368,7 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
led->brightness = brightness;
spin_unlock_irqrestore(&led->lock, flags);
schedule_work(&led->work);
asus_schedule_work(led);
}
static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
@ -382,9 +392,6 @@ static void asus_kbd_backlight_work(struct work_struct *work)
int ret;
unsigned long flags;
if (led->removed)
return;
spin_lock_irqsave(&led->lock, flags);
buf[4] = led->brightness;
spin_unlock_irqrestore(&led->lock, flags);