Commit a4cc1d63 authored by Pietro Borrello's avatar Pietro Borrello Committed by Jialin Zhang
Browse files

HID: asus: use spinlock to safely schedule workers 

mainline inclusion
from mainline-v6.2
commit 4ab3a086
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6I7U9
CVE: CVE-2023-1079

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4ab3a086d10eeec1424f2e8a968827a6336203df



--------------------------------

Use spinlocks to deal with workers introducing a wrapper
asus_schedule_work(), and several spinlock checks.
Otherwise, asus_kbd_backlight_set() may schedule led->work after the
structure has been freed, causing a use-after-free.

Fixes: af22a610 ("HID: asus: support backlight on USB keyboards")
Signed-off-by: default avatarPietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it


Signed-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarYuyao Lin <linyuyao1@huawei.com>
Reviewed-by: default avatarWei Li <liwei391@huawei.com>
Reviewed-by: default avatarWang Weiyang <wangweiyang2@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent 9745c891

drivers/hid/hid-asus.c

+11 −4
Original line number Diff line number Diff line
@@ -398,6 +398,16 @@ static int asus_kbd_get_functions(struct hid_device *hdev, 
	return ret;

}



static void asus_schedule_work(struct asus_kbd_leds *led)

{

	unsigned long flags;



	spin_lock_irqsave(&led->lock, flags);

	if (!led->removed)

		schedule_work(&led->work);

	spin_unlock_irqrestore(&led->lock, flags);

}



static void asus_kbd_backlight_set(struct led_classdev *led_cdev,

				   enum led_brightness brightness)

{
@@ -409,7 +419,7 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, 
	led->brightness = brightness;

	spin_unlock_irqrestore(&led->lock, flags);



	schedule_work(&led->work);

	asus_schedule_work(led);

}



static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
@@ -433,9 +443,6 @@ static void asus_kbd_backlight_work(struct work_struct *work) 
	int ret;

	unsigned long flags;



	if (led->removed)

		return;



	spin_lock_irqsave(&led->lock, flags);

	buf[4] = led->brightness;

	spin_unlock_irqrestore(&led->lock, flags);