4.14-stable patches

added patches:
	hid-asus-remove-check-for-same-led-brightness-on-set.patch
	hid-asus-use-spinlock-to-protect-concurrent-accesses.patch
	hid-asus-use-spinlock-to-safely-schedule-workers.patch

diff --git a/queue-4.14/hid-asus-remove-check-for-same-led-brightness-on-set.patch b/queue-4.14/hid-asus-remove-check-for-same-led-brightness-on-set.patch
new file mode 100644 (file)
index 0000000..dc14f02
--- /dev/null
+++ b/queue-4.14/hid-asus-remove-check-for-same-led-brightness-on-set.patch
@@ -0,0 +1,35 @@
+From 3fdcf7cdfc229346d028242e73562704ad644dd0 Mon Sep 17 00:00:00 2001
+From: "Luke D. Jones" <luke@ljones.dev>
+Date: Mon, 5 Jul 2021 10:26:59 +1200
+Subject: HID: asus: Remove check for same LED brightness on set
+
+From: Luke D. Jones <luke@ljones.dev>
+
+commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream.
+
+Remove the early return on LED brightness set so that any controller
+application, daemon, or desktop may set the same brightness at any stage.
+
+This is required because many ASUS ROG keyboards will default to max
+brightness on laptop resume if the LEDs were set to off before sleep.
+
+Signed-off-by: Luke D Jones <luke@ljones.dev>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-asus.c |    3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -298,9 +298,6 @@ static void asus_kbd_backlight_set(struc
+ {
+       struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
+                                                cdev);
+-      if (led->brightness == brightness)
+-              return;
+-
+       led->brightness = brightness;
+       schedule_work(&led->work);
+ }

diff --git a/queue-4.14/hid-asus-use-spinlock-to-protect-concurrent-accesses.patch b/queue-4.14/hid-asus-use-spinlock-to-protect-concurrent-accesses.patch
new file mode 100644 (file)
index 0000000..9273c7e
--- /dev/null
+++ b/queue-4.14/hid-asus-use-spinlock-to-protect-concurrent-accesses.patch
@@ -0,0 +1,98 @@
+From 315c537068a13f0b5681d33dd045a912f4bece6f Mon Sep 17 00:00:00 2001
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+Date: Sun, 12 Feb 2023 19:00:02 +0000
+Subject: HID: asus: use spinlock to protect concurrent accesses
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+commit 315c537068a13f0b5681d33dd045a912f4bece6f upstream.
+
+asus driver has a worker that may access data concurrently.
+Proct the accesses using a spinlock.
+
+Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-4-7860c5763c38@diag.uniroma1.it
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-asus.c |   22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -82,6 +82,7 @@ struct asus_kbd_leds {
+       struct hid_device *hdev;
+       struct work_struct work;
+       unsigned int brightness;
++      spinlock_t lock;
+       bool removed;
+ };
+ 
+@@ -298,7 +299,12 @@ static void asus_kbd_backlight_set(struc
+ {
+       struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
+                                                cdev);
++      unsigned long flags;
++
++      spin_lock_irqsave(&led->lock, flags);
+       led->brightness = brightness;
++      spin_unlock_irqrestore(&led->lock, flags);
++
+       schedule_work(&led->work);
+ }
+ 
+@@ -306,8 +312,14 @@ static enum led_brightness asus_kbd_back
+ {
+       struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
+                                                cdev);
++      enum led_brightness brightness;
++      unsigned long flags;
+ 
+-      return led->brightness;
++      spin_lock_irqsave(&led->lock, flags);
++      brightness = led->brightness;
++      spin_unlock_irqrestore(&led->lock, flags);
++
++      return brightness;
+ }
+ 
+ static void asus_kbd_backlight_work(struct work_struct *work)
+@@ -315,11 +327,14 @@ static void asus_kbd_backlight_work(stru
+       struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work);
+       u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 };
+       int ret;
++      unsigned long flags;
+ 
+       if (led->removed)
+               return;
+ 
++      spin_lock_irqsave(&led->lock, flags);
+       buf[4] = led->brightness;
++      spin_unlock_irqrestore(&led->lock, flags);
+ 
+       ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf));
+       if (ret < 0)
+@@ -360,6 +375,7 @@ static int asus_kbd_register_leds(struct
+       drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set;
+       drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get;
+       INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work);
++      spin_lock_init(&drvdata->kbd_backlight->lock);
+ 
+       ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev);
+       if (ret < 0) {
+@@ -658,9 +674,13 @@ err_stop_hw:
+ static void asus_remove(struct hid_device *hdev)
+ {
+       struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
++      unsigned long flags;
+ 
+       if (drvdata->kbd_backlight) {
++              spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags);
+               drvdata->kbd_backlight->removed = true;
++              spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags);
++
+               cancel_work_sync(&drvdata->kbd_backlight->work);
+       }
+ 

diff --git a/queue-4.14/hid-asus-use-spinlock-to-safely-schedule-workers.patch b/queue-4.14/hid-asus-use-spinlock-to-safely-schedule-workers.patch
new file mode 100644 (file)
index 0000000..219eb1a
--- /dev/null
+++ b/queue-4.14/hid-asus-use-spinlock-to-safely-schedule-workers.patch
@@ -0,0 +1,62 @@
+From 4ab3a086d10eeec1424f2e8a968827a6336203df Mon Sep 17 00:00:00 2001
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+Date: Sun, 12 Feb 2023 19:00:03 +0000
+Subject: HID: asus: use spinlock to safely schedule workers
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream.
+
+Use spinlocks to deal with workers introducing a wrapper
+asus_schedule_work(), and several spinlock checks.
+Otherwise, asus_kbd_backlight_set() may schedule led->work after the
+structure has been freed, causing a use-after-free.
+
+Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-asus.c |   15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -294,6 +294,16 @@ static int asus_kbd_get_functions(struct
+       return ret;
+ }
+ 
++static void asus_schedule_work(struct asus_kbd_leds *led)
++{
++      unsigned long flags;
++
++      spin_lock_irqsave(&led->lock, flags);
++      if (!led->removed)
++              schedule_work(&led->work);
++      spin_unlock_irqrestore(&led->lock, flags);
++}
++
+ static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
+                                  enum led_brightness brightness)
+ {
+@@ -305,7 +315,7 @@ static void asus_kbd_backlight_set(struc
+       led->brightness = brightness;
+       spin_unlock_irqrestore(&led->lock, flags);
+ 
+-      schedule_work(&led->work);
++      asus_schedule_work(led);
+ }
+ 
+ static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
+@@ -329,9 +339,6 @@ static void asus_kbd_backlight_work(stru
+       int ret;
+       unsigned long flags;
+ 
+-      if (led->removed)
+-              return;
+-
+       spin_lock_irqsave(&led->lock, flags);
+       buf[4] = led->brightness;
+       spin_unlock_irqrestore(&led->lock, flags);

diff --git a/queue-4.14/series b/queue-4.14/series
index 449dbe3fdbb8dd1b182eb400a60b58b37ef2f658..7ebfcfe67a5e2945f1995a19d2dc502877660c93 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -9,3 +9,6 @@ bpf-fix-truncation-handling-for-mod32-dst-reg-wrt-zero.patch
 dmaengine-sh-rcar-dmac-check-for-error-num-after-dma_set_max_seg_size.patch
 usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch
 usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch
+hid-asus-remove-check-for-same-led-brightness-on-set.patch
+hid-asus-use-spinlock-to-protect-concurrent-accesses.patch
+hid-asus-use-spinlock-to-safely-schedule-workers.patch