HID: asus: use spinlock to safely schedule workers

commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream.

Use spinlocks to deal with workers introducing a wrapper
asus_schedule_work(), and several spinlock checks.
Otherwise, asus_kbd_backlight_set() may schedule led->work after the
structure has been freed, causing a use-after-free.

Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 9f767ba..d1094bb 100644 (file)
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -491,6 +491,16 @@ static int rog_nkey_led_init(struct hid_device *hdev)
        return ret;
 }
 
+static void asus_schedule_work(struct asus_kbd_leds *led)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(&led->lock, flags);
+       if (!led->removed)
+               schedule_work(&led->work);
+       spin_unlock_irqrestore(&led->lock, flags);
+}
+
 static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
                                   enum led_brightness brightness)
 {
@@ -502,7 +512,7 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
        led->brightness = brightness;
        spin_unlock_irqrestore(&led->lock, flags);
 
-       schedule_work(&led->work);
+       asus_schedule_work(led);
 }
 
 static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
@@ -526,9 +536,6 @@ static void asus_kbd_backlight_work(struct work_struct *work)
        int ret;
        unsigned long flags;
 
-       if (led->removed)
-               return;
-
        spin_lock_irqsave(&led->lock, flags);
        buf[4] = led->brightness;
        spin_unlock_irqrestore(&led->lock, flags);