Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dd08e68d authored by Pietro Borrello's avatar Pietro Borrello Committed by Greg Kroah-Hartman
Browse files

HID: asus: use spinlock to safely schedule workers 



commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream.

Use spinlocks to deal with workers introducing a wrapper
asus_schedule_work(), and several spinlock checks.
Otherwise, asus_kbd_backlight_set() may schedule led->work after the
structure has been freed, causing a use-after-free.

Fixes: af22a610 ("HID: asus: support backlight on USB keyboards")
Signed-off-by: default avatarPietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it


Signed-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarStefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 136a9bcc

drivers/hid/hid-asus.c

+11 −4
Original line number Diff line number Diff line
@@ -347,6 +347,16 @@ static int asus_kbd_get_functions(struct hid_device *hdev, 
	return ret;

}



static void asus_schedule_work(struct asus_kbd_leds *led)

{

	unsigned long flags;



	spin_lock_irqsave(&led->lock, flags);

	if (!led->removed)

		schedule_work(&led->work);

	spin_unlock_irqrestore(&led->lock, flags);

}



static void asus_kbd_backlight_set(struct led_classdev *led_cdev,

				   enum led_brightness brightness)

{
@@ -358,7 +368,7 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, 
	led->brightness = brightness;

	spin_unlock_irqrestore(&led->lock, flags);



	schedule_work(&led->work);

	asus_schedule_work(led);

}



static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
@@ -382,9 +392,6 @@ static void asus_kbd_backlight_work(struct work_struct *work) 
	int ret;

	unsigned long flags;



	if (led->removed)

		return;



	spin_lock_irqsave(&led->lock, flags);

	buf[4] = led->brightness;

	spin_unlock_irqrestore(&led->lock, flags);