android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

USB: appledisplay: close race between probe and completion handler

Browse Source 
commit 8265d06b7794493d82c5c21a12d7ba43eccc30cb upstream.

There is a small window during probing when IO is running
but the backlight is not registered. Processing events
during that time will crash. The completion handler
needs to check for a backlight before scheduling work.

The bug is as old as the driver.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240912123317.1026049-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Oliver Neukum 2024-09-12 14:32:59 +02:00 committed by Greg Kroah-Hartman
parent 84f4d44703
commit 1c5cd41b4b
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/usb/misc/appledisplay.c
View File

@ -107,7 +107,12 @@ static void appledisplay_complete(struct urb *urb)
case ACD_BTN_BRIGHT_UP: case ACD_BTN_BRIGHT_UP:
case ACD_BTN_BRIGHT_DOWN: case ACD_BTN_BRIGHT_DOWN:
pdata->button_pressed = 1; pdata->button_pressed = 1;
schedule_delayed_work(&pdata->work, 0); /*
* there is a window during which no device
* is registered
*/
if (pdata->bd )
schedule_delayed_work(&pdata->work, 0);
break; break;
case ACD_BTN_NONE: case ACD_BTN_NONE:
default: default:
@ -202,6 +207,7 @@ static int appledisplay_probe(struct usb_interface *iface,
const struct usb_device_id *id) const struct usb_device_id *id)
{ {
struct backlight_properties props; struct backlight_properties props;
struct backlight_device *backlight;
struct appledisplay *pdata; struct appledisplay *pdata;
struct usb_device *udev = interface_to_usbdev(iface); struct usb_device *udev = interface_to_usbdev(iface);
struct usb_endpoint_descriptor *endpoint; struct usb_endpoint_descriptor *endpoint;
@ -272,13 +278,14 @@ static int appledisplay_probe(struct usb_interface *iface,
memset(&props, 0, sizeof(struct backlight_properties)); memset(&props, 0, sizeof(struct backlight_properties));
props.type = BACKLIGHT_RAW; props.type = BACKLIGHT_RAW;
props.max_brightness = 0xff; props.max_brightness = 0xff;
pdata->bd = backlight_device_register(bl_name, NULL, pdata, backlight = backlight_device_register(bl_name, NULL, pdata,
&appledisplay_bl_data, &props); &appledisplay_bl_data, &props);
if (IS_ERR(pdata->bd)) { if (IS_ERR(backlight)) {
dev_err(&iface->dev, "Backlight registration failed\n"); dev_err(&iface->dev, "Backlight registration failed\n");
retval = PTR_ERR(pdata->bd); retval = PTR_ERR(backlight);
goto error; goto error;
} }
pdata->bd = backlight;
/* Try to get brightness */ /* Try to get brightness */
brightness = appledisplay_bl_get_brightness(pdata->bd); brightness = appledisplay_bl_get_brightness(pdata->bd);