On Feb 09 2023, Pietro Borrello wrote:
> Use spinlocks to deal with workers introducing a wrapper
> asus_schedule_work(), and several spinlock checks.
> Otherwise, asus_kbd_backlight_set() may schedule led->work after the
> structure has been freed, causing a use-after-free.
>
> Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards")
> Signed-off-by: Pietro Borrello <borrello@xxxxxxxxxxxxxxxx>
> ---
> drivers/hid/hid-asus.c | 24 +++++++++++++++++++++---
> 1 file changed, 21 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
> index f99752b998f3..30e194803bd7 100644
> --- a/drivers/hid/hid-asus.c
> +++ b/drivers/hid/hid-asus.c
> @@ -98,6 +98,7 @@ struct asus_kbd_leds {
> struct hid_device *hdev;
> struct work_struct work;
> unsigned int brightness;
> + spinlock_t lock;
> bool removed;
> };
>
> @@ -490,13 +491,23 @@ static int rog_nkey_led_init(struct hid_device *hdev)
> return ret;
> }
>
> +static void asus_schedule_work(struct asus_kbd_leds *led)
> +{
> + unsigned long flags;
> +
> + spin_lock_irqsave(&led->lock, flags);
> + if (!led->removed)
> + schedule_work(&led->work);
> + spin_unlock_irqrestore(&led->lock, flags);
> +}
> +
> static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
> enum led_brightness brightness)
> {
> struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
> cdev);
> led->brightness = brightness;
> - schedule_work(&led->work);
> + asus_schedule_work(led);
> }
>
> static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
> @@ -512,15 +523,17 @@ static void asus_kbd_backlight_work(struct work_struct *work)
> struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work);
> u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 };
> int ret;
> + unsigned long flags;
>
> - if (led->removed)
> - return;
> + spin_lock_irqsave(&led->lock, flags);
>
> buf[4] = led->brightness;
>
> ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf));
> if (ret < 0)
> hid_err(led->hdev, "Asus failed to set keyboard backlight: %d\n", ret);
> +
> + spin_unlock_irqrestore(&led->lock, flags);
Same as in 1/2, please only keep "buf[4] = led->brightness;" under
spinlock.
Which also raises the question on why the other accesses of
led->brightness are not protected by the spinlock :)
Note that we could use an atomic to not use the spinlock, but we need
the spinlock anyway...
Cheers,
Benjamin
> }
>
> /* WMI-based keyboard backlight LED control (via asus-wmi driver) takes
> @@ -584,6 +597,7 @@ static int asus_kbd_register_leds(struct hid_device *hdev)
> drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set;
> drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get;
> INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work);
> + spin_lock_init(&drvdata->kbd_backlight->lock);
>
> ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev);
> if (ret < 0) {
> @@ -1119,9 +1133,13 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
> static void asus_remove(struct hid_device *hdev)
> {
> struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
> + unsigned long flags;
>
> if (drvdata->kbd_backlight) {
> + spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags);
> drvdata->kbd_backlight->removed = true;
> + spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags);
> +
> cancel_work_sync(&drvdata->kbd_backlight->work);
> }
>
>
> --
> 2.25.1
>
