From e4465713a1746b4b9c3874142a359a463e2e0cc8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 3 Mar 2023 16:57:06 +0100 Subject: [PATCH] 4.14-stable patches added patches: hid-asus-remove-check-for-same-led-brightness-on-set.patch hid-asus-use-spinlock-to-protect-concurrent-accesses.patch hid-asus-use-spinlock-to-safely-schedule-workers.patch --- ...check-for-same-led-brightness-on-set.patch | 35 +++++++ ...nlock-to-protect-concurrent-accesses.patch | 98 +++++++++++++++++++ ...-spinlock-to-safely-schedule-workers.patch | 62 ++++++++++++ queue-4.14/series | 3 + 4 files changed, 198 insertions(+) create mode 100644 queue-4.14/hid-asus-remove-check-for-same-led-brightness-on-set.patch create mode 100644 queue-4.14/hid-asus-use-spinlock-to-protect-concurrent-accesses.patch create mode 100644 queue-4.14/hid-asus-use-spinlock-to-safely-schedule-workers.patch diff --git a/queue-4.14/hid-asus-remove-check-for-same-led-brightness-on-set.patch b/queue-4.14/hid-asus-remove-check-for-same-led-brightness-on-set.patch new file mode 100644 index 00000000000..dc14f02dd59 --- /dev/null +++ b/queue-4.14/hid-asus-remove-check-for-same-led-brightness-on-set.patch @@ -0,0 +1,35 @@ +From 3fdcf7cdfc229346d028242e73562704ad644dd0 Mon Sep 17 00:00:00 2001 +From: "Luke D. Jones" +Date: Mon, 5 Jul 2021 10:26:59 +1200 +Subject: HID: asus: Remove check for same LED brightness on set + +From: Luke D. Jones + +commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream. + +Remove the early return on LED brightness set so that any controller +application, daemon, or desktop may set the same brightness at any stage. + +This is required because many ASUS ROG keyboards will default to max +brightness on laptop resume if the LEDs were set to off before sleep. + +Signed-off-by: Luke D Jones +Signed-off-by: Jiri Kosina +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-asus.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -298,9 +298,6 @@ static void asus_kbd_backlight_set(struc + { + struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, + cdev); +- if (led->brightness == brightness) +- return; +- + led->brightness = brightness; + schedule_work(&led->work); + } diff --git a/queue-4.14/hid-asus-use-spinlock-to-protect-concurrent-accesses.patch b/queue-4.14/hid-asus-use-spinlock-to-protect-concurrent-accesses.patch new file mode 100644 index 00000000000..9273c7e6172 --- /dev/null +++ b/queue-4.14/hid-asus-use-spinlock-to-protect-concurrent-accesses.patch @@ -0,0 +1,98 @@ +From 315c537068a13f0b5681d33dd045a912f4bece6f Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:02 +0000 +Subject: HID: asus: use spinlock to protect concurrent accesses + +From: Pietro Borrello + +commit 315c537068a13f0b5681d33dd045a912f4bece6f upstream. + +asus driver has a worker that may access data concurrently. +Proct the accesses using a spinlock. + +Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-4-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-asus.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -82,6 +82,7 @@ struct asus_kbd_leds { + struct hid_device *hdev; + struct work_struct work; + unsigned int brightness; ++ spinlock_t lock; + bool removed; + }; + +@@ -298,7 +299,12 @@ static void asus_kbd_backlight_set(struc + { + struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, + cdev); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&led->lock, flags); + led->brightness = brightness; ++ spin_unlock_irqrestore(&led->lock, flags); ++ + schedule_work(&led->work); + } + +@@ -306,8 +312,14 @@ static enum led_brightness asus_kbd_back + { + struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, + cdev); ++ enum led_brightness brightness; ++ unsigned long flags; + +- return led->brightness; ++ spin_lock_irqsave(&led->lock, flags); ++ brightness = led->brightness; ++ spin_unlock_irqrestore(&led->lock, flags); ++ ++ return brightness; + } + + static void asus_kbd_backlight_work(struct work_struct *work) +@@ -315,11 +327,14 @@ static void asus_kbd_backlight_work(stru + struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work); + u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 }; + int ret; ++ unsigned long flags; + + if (led->removed) + return; + ++ spin_lock_irqsave(&led->lock, flags); + buf[4] = led->brightness; ++ spin_unlock_irqrestore(&led->lock, flags); + + ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf)); + if (ret < 0) +@@ -360,6 +375,7 @@ static int asus_kbd_register_leds(struct + drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set; + drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get; + INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work); ++ spin_lock_init(&drvdata->kbd_backlight->lock); + + ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev); + if (ret < 0) { +@@ -658,9 +674,13 @@ err_stop_hw: + static void asus_remove(struct hid_device *hdev) + { + struct asus_drvdata *drvdata = hid_get_drvdata(hdev); ++ unsigned long flags; + + if (drvdata->kbd_backlight) { ++ spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags); + drvdata->kbd_backlight->removed = true; ++ spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags); ++ + cancel_work_sync(&drvdata->kbd_backlight->work); + } + diff --git a/queue-4.14/hid-asus-use-spinlock-to-safely-schedule-workers.patch b/queue-4.14/hid-asus-use-spinlock-to-safely-schedule-workers.patch new file mode 100644 index 00000000000..219eb1a537a --- /dev/null +++ b/queue-4.14/hid-asus-use-spinlock-to-safely-schedule-workers.patch @@ -0,0 +1,62 @@ +From 4ab3a086d10eeec1424f2e8a968827a6336203df Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:03 +0000 +Subject: HID: asus: use spinlock to safely schedule workers + +From: Pietro Borrello + +commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream. + +Use spinlocks to deal with workers introducing a wrapper +asus_schedule_work(), and several spinlock checks. +Otherwise, asus_kbd_backlight_set() may schedule led->work after the +structure has been freed, causing a use-after-free. + +Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-asus.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -294,6 +294,16 @@ static int asus_kbd_get_functions(struct + return ret; + } + ++static void asus_schedule_work(struct asus_kbd_leds *led) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&led->lock, flags); ++ if (!led->removed) ++ schedule_work(&led->work); ++ spin_unlock_irqrestore(&led->lock, flags); ++} ++ + static void asus_kbd_backlight_set(struct led_classdev *led_cdev, + enum led_brightness brightness) + { +@@ -305,7 +315,7 @@ static void asus_kbd_backlight_set(struc + led->brightness = brightness; + spin_unlock_irqrestore(&led->lock, flags); + +- schedule_work(&led->work); ++ asus_schedule_work(led); + } + + static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev) +@@ -329,9 +339,6 @@ static void asus_kbd_backlight_work(stru + int ret; + unsigned long flags; + +- if (led->removed) +- return; +- + spin_lock_irqsave(&led->lock, flags); + buf[4] = led->brightness; + spin_unlock_irqrestore(&led->lock, flags); diff --git a/queue-4.14/series b/queue-4.14/series index 449dbe3fdbb..7ebfcfe67a5 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -9,3 +9,6 @@ bpf-fix-truncation-handling-for-mod32-dst-reg-wrt-zero.patch dmaengine-sh-rcar-dmac-check-for-error-num-after-dma_set_max_seg_size.patch usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch +hid-asus-remove-check-for-same-led-brightness-on-set.patch +hid-asus-use-spinlock-to-protect-concurrent-accesses.patch +hid-asus-use-spinlock-to-safely-schedule-workers.patch -- 2.47.3