Skip to contentSkip to conversation

Patch "platform/x86: xiaomi-wmi: Fix race condition when reporting key events" has been added to the 5.15-stable tree

DISCUSSION Armin Wolf 1 participant 1 message May 26, 2024 1 message not in the archive Stable branch

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Armin Wolf

author
#1 lore raw

Am 26.05.24 um 22:07 schrieb Sasha Levin:

Quoted 7 lines

This is a note to let you know that I've just added the patch titled

platform/x86: xiaomi-wmi: Fix race condition when reporting key events

to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

Quoted 7 lines

The filename of the patch is:
platform-x86-xiaomi-wmi-fix-race-condition-when-repo.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Hi,

the underlying race condition can only be triggered since
commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs"), which afaik was introduced with kernel 6.8.

Because of this, i do not think that we have to backport this commit to kernels before 6.8.

Thanks,
Armin Wolf

Quoted 88 lines

commit 1f436551dd453c28c23f800e7273136e526197cb

Author: Armin Wolf <[email protected]>
Date:   Tue Apr 2 16:30:57 2024 +0200

platform/x86: xiaomi-wmi: Fix race condition when reporting key events

[ Upstream commit 290680c2da8061e410bcaec4b21584ed951479af ]

Multiple WMI events can be received concurrently, so multiple instances of xiaomi_wmi_notify() can be active at the same time. Since the input device is shared between those handlers, the key input sequence can be disturbed.

Fix this by protecting the key input sequence with a mutex.

Compile-tested only.

drivers/platform/x86/xiaomi-wmi.c +18 -0
index 54a2546bb93bf..be80f0bda9484 100644
@@ -2,8 +2,10 @@
  /* WMI driver for Xiaomi Laptops */
 
  #include <linux/acpi.h>
+#include <linux/device.h>
  #include <linux/input.h>
  #include <linux/module.h>
+#include <linux/mutex.h>
  #include <linux/wmi.h>
 
  #include <uapi/linux/input-event-codes.h>
@@ -20,12 +22,21 @@
 
  struct xiaomi_wmi {
  	struct input_dev *input_dev;
+	struct mutex key_lock;	/* Protects the key event sequence */
  	unsigned int key_code;
  };
 
+static void xiaomi_mutex_destroy(void *data)
+{
+	struct mutex *lock = data;
+
+	mutex_destroy(lock);
+}
+
  static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context)
  {
  	struct xiaomi_wmi *data;
+	int ret;
 
  	if (wdev == NULL || context == NULL)
  		return -EINVAL;
@@ -35,6 +46,11 @@ static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context)
  		return -ENOMEM;
  	dev_set_drvdata(&wdev->dev, data);
 
+	mutex_init(&data->key_lock);
+	ret = devm_add_action_or_reset(&wdev->dev, xiaomi_mutex_destroy, &data->key_lock);
+	if (ret < 0)
+		return ret;
+
  	data->input_dev = devm_input_allocate_device(&wdev->dev);
  	if (data->input_dev == NULL)
  		return -ENOMEM;
@@ -59,10 +75,12 @@ static void xiaomi_wmi_notify(struct wmi_device *wdev, union acpi_object *dummy)
  	if (data == NULL)
  		return;
 
+	mutex_lock(&data->key_lock);
  	input_report_key(data->input_dev, data->key_code, 1);
  	input_sync(data->input_dev);
  	input_report_key(data->input_dev, data->key_code, 0);
  	input_sync(data->input_dev);
+	mutex_unlock(&data->key_lock);
  }
 
  static const struct wmi_device_id xiaomi_wmi_id_table[] = {