Re: [PATCH v3 2/2] HID: asus: use spinlock to safely schedule workers

[Benjamin Tissoires]

On Feb 09 2023, Pietro Borrello wrote:
> Use spinlocks to deal with workers introducing a wrapper
> asus_schedule_work(), and several spinlock checks.
> Otherwise, asus_kbd_backlight_set() may schedule led->work after the
> structure has been freed, causing a use-after-free.
> 
> Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards")
> Signed-off-by: Pietro Borrello <borrello@xxxxxxxxxxxxxxxx>
> ---
>  drivers/hid/hid-asus.c | 24 +++++++++++++++++++++---
>  1 file changed, 21 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
> index f99752b998f3..30e194803bd7 100644
> --- a/drivers/hid/hid-asus.c
> +++ b/drivers/hid/hid-asus.c
> @@ -98,6 +98,7 @@ struct asus_kbd_leds {
>  	struct hid_device *hdev;
>  	struct work_struct work;
>  	unsigned int brightness;
> +	spinlock_t lock;
>  	bool removed;
>  };
>  
> @@ -490,13 +491,23 @@ static int rog_nkey_led_init(struct hid_device *hdev)
>  	return ret;
>  }
>  
> +static void asus_schedule_work(struct asus_kbd_leds *led)
> +{
> +	unsigned long flags;
> +
> +	spin_lock_irqsave(&led->lock, flags);
> +	if (!led->removed)
> +		schedule_work(&led->work);
> +	spin_unlock_irqrestore(&led->lock, flags);
> +}
> +
>  static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
>  				   enum led_brightness brightness)
>  {
>  	struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
>  						 cdev);
>  	led->brightness = brightness;
> -	schedule_work(&led->work);
> +	asus_schedule_work(led);
>  }
>  
>  static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
> @@ -512,15 +523,17 @@ static void asus_kbd_backlight_work(struct work_struct *work)
>  	struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work);
>  	u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 };
>  	int ret;
> +	unsigned long flags;
>  
> -	if (led->removed)
> -		return;
> +	spin_lock_irqsave(&led->lock, flags);
>  
>  	buf[4] = led->brightness;
>  
>  	ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf));
>  	if (ret < 0)
>  		hid_err(led->hdev, "Asus failed to set keyboard backlight: %d\n", ret);
> +
> +	spin_unlock_irqrestore(&led->lock, flags);

Same as in 1/2, please only keep "buf[4] = led->brightness;" under
spinlock.

Which also raises the question on why the other accesses of
led->brightness are not protected by the spinlock :)

Note that we could use an atomic to not use the spinlock, but we need
the spinlock anyway...

Cheers,
Benjamin

>  }
>  
>  /* WMI-based keyboard backlight LED control (via asus-wmi driver) takes
> @@ -584,6 +597,7 @@ static int asus_kbd_register_leds(struct hid_device *hdev)
>  	drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set;
>  	drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get;
>  	INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work);
> +	spin_lock_init(&drvdata->kbd_backlight->lock);
>  
>  	ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev);
>  	if (ret < 0) {
> @@ -1119,9 +1133,13 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
>  static void asus_remove(struct hid_device *hdev)
>  {
>  	struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
> +	unsigned long flags;
>  
>  	if (drvdata->kbd_backlight) {
> +		spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags);
>  		drvdata->kbd_backlight->removed = true;
> +		spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags);
> +
>  		cancel_work_sync(&drvdata->kbd_backlight->work);
>  	}
>  
> 
> -- 
> 2.25.1
>