Commit 4ab3a086 authored by Pietro Borrello's avatar Pietro Borrello Committed by Benjamin Tissoires

HID: asus: use spinlock to safely schedule workers

Use spinlocks to deal with workers introducing a wrapper
asus_schedule_work(), and several spinlock checks.
Otherwise, asus_kbd_backlight_set() may schedule led->work after the
structure has been freed, causing a use-after-free.

Fixes: af22a610 ("HID: asus: support backlight on USB keyboards")
Signed-off-by: default avatarPietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.itSigned-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
parent 315c5370
...@@ -491,6 +491,16 @@ static int rog_nkey_led_init(struct hid_device *hdev) ...@@ -491,6 +491,16 @@ static int rog_nkey_led_init(struct hid_device *hdev)
return ret; return ret;
} }
static void asus_schedule_work(struct asus_kbd_leds *led)
{
unsigned long flags;
spin_lock_irqsave(&led->lock, flags);
if (!led->removed)
schedule_work(&led->work);
spin_unlock_irqrestore(&led->lock, flags);
}
static void asus_kbd_backlight_set(struct led_classdev *led_cdev, static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
enum led_brightness brightness) enum led_brightness brightness)
{ {
...@@ -502,7 +512,7 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, ...@@ -502,7 +512,7 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
led->brightness = brightness; led->brightness = brightness;
spin_unlock_irqrestore(&led->lock, flags); spin_unlock_irqrestore(&led->lock, flags);
schedule_work(&led->work); asus_schedule_work(led);
} }
static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev) static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
...@@ -526,9 +536,6 @@ static void asus_kbd_backlight_work(struct work_struct *work) ...@@ -526,9 +536,6 @@ static void asus_kbd_backlight_work(struct work_struct *work)
int ret; int ret;
unsigned long flags; unsigned long flags;
if (led->removed)
return;
spin_lock_irqsave(&led->lock, flags); spin_lock_irqsave(&led->lock, flags);
buf[4] = led->brightness; buf[4] = led->brightness;
spin_unlock_irqrestore(&led->lock, flags); spin_unlock_irqrestore(&led->lock, flags);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment