Received-SPF: pass (google.com: domain of linux-kernel+bounces-122052-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
From: Armin Wolf <W_Armin@gmx.de>
To: hdegoede@redhat.com,
	ilpo.jarvinen@linux.intel.com
Cc: rafael@kernel.org,
	linux-acpi@vger.kernel.org,
	platform-driver-x86@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH] platform/x86: quickstart: Fix race condition when reporting input event
Date: Wed, 27 Mar 2024 22:45:24 +0100
Message-Id: <20240327214524.123935-1-W_Armin@gmx.de>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:l7VohZ+Mi0U=;qHYGmA6f8S3wH6OloSmE0xOZGwb
 GmioLyNMQCiFBW50tsCTT1BxS2MEr1lDyCotIa7Y/cxDy96zU05zOjt1QMCI3aVjBMp8oYnRn
 XRvlveZk+IIp+j4yZsFmN2Owd216beUwXIf7DLePzATNVDHpR8ex7vAuJrUz56yoGdImTiEBM
 cc/3ecJqkjV2Mp6ZuD0WfzAczm5VUgOaim+/fo/8ZhqZ6moTNlrQgMwaqe/4m8s/sWsV5JlWO
 TK/QrRAzFkUbBY97PUKUx0YGozN0OACpTDl9LDvIVkCgrTXnIbUmKtumxZSWlmLfxhTw4rGuy
 uRc2bEB/TYz21rJN/JLDdb3i/t/n6ExnOkiuqdUFn4QOEHyxi8ssqKDCpRK1AMlJKTWxQ3ClT
 oeCRtZ4U+Xj+yV29fhrkUSoYmLARGBurOhP5SdIkUNJfeH+CHWTuQwB835ap3nwxywoXKUsEw
 MeL17BeWUljhRDSKGmqBoganLS1Mm+82VlbKx5nUaGWKvQQJW0dShTQpUYLE8fi7CJ1uRmFQ1
 giPklp84gvUSm43v5+vpuzHa5pp6JhZigJwl2HjVv3kGzTXM0I+6XSc2rYHi1mqkg31e3ZZKF
 plAYUaU+Cy9qQ5lTCDX/Epsh6EilLw9TY/3YsakvGk3KVChX68Puqv0CmyFqWMs6tqMl/HGdc
 MDFePFXh8eMke8FOCGGG5NfEa36asU4R0LaFhlumLemktx5guSE75MbVEKayOv96kBCCsTgXA
 OFAshHkDuEUrGu90dsmZslsAmL7MRZ/IRAyKtr/4tiu/YA1VNYa/nrOP1B8scZi5EzFz/+wG0
 82GwB4kvFCotcCjWRrHQmRvUck5zD7aPZxWav3bs4QlAc=

Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run
on all CPUs"), the ACPI core allows multiple notify calls to be active
at the same time. This means that two instances of quickstart_notify()
running at the same time can mess which each others input sequences.

Fix this by protecting the input sequence with a mutex.

Compile-tested only.

Fixes: afd66f2a739e ("platform/x86: Add ACPI quickstart button (PNP0C32) d=
river")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
This applies on the branch "review-hans". Maybe we could somehow
document the concurrency rules for ACPI notify handlers?
=2D--
 drivers/platform/x86/quickstart.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/platform/x86/quickstart.c b/drivers/platform/x86/quic=
kstart.c
index ba3a7a25dda7..e40f852d42c1 100644
=2D-- a/drivers/platform/x86/quickstart.c
+++ b/drivers/platform/x86/quickstart.c
@@ -18,6 +18,7 @@
 #include <linux/input/sparse-keymap.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/platform_device.h>
 #include <linux/sysfs.h>
 #include <linux/types.h>
@@ -35,6 +36,7 @@

 struct quickstart_data {
 	struct device *dev;
+	struct mutex input_lock;	/* Protects input sequence during notify */
 	struct input_dev *input_device;
 	char input_name[32];
 	char phys[32];
@@ -73,7 +75,10 @@ static void quickstart_notify(acpi_handle handle, u32 e=
vent, void *context)

 	switch (event) {
 	case QUICKSTART_EVENT_RUNTIME:
+		mutex_lock(&data->input_lock);
 		sparse_keymap_report_event(data->input_device, 0x1, 1, true);
+		mutex_unlock(&data->input_lock);
+
 		acpi_bus_generate_netlink_event(DRIVER_NAME, dev_name(data->dev), event=
, 0);
 		break;
 	default:
@@ -147,6 +152,13 @@ static void quickstart_notify_remove(void *context)
 	acpi_remove_notify_handler(handle, ACPI_DEVICE_NOTIFY, quickstart_notify=
);
 }

+static void quickstart_mutex_destroy(void *data)
+{
+	struct mutex *lock =3D data;
+
+	mutex_destroy(lock);
+}
+
 static int quickstart_probe(struct platform_device *pdev)
 {
 	struct quickstart_data *data;
@@ -165,6 +177,11 @@ static int quickstart_probe(struct platform_device *p=
dev)
 	data->dev =3D &pdev->dev;
 	dev_set_drvdata(&pdev->dev, data);

+	mutex_init(&data->input_lock);
+	ret =3D devm_add_action_or_reset(&pdev->dev, quickstart_mutex_destroy, &=
data->input_lock);
+	if (ret < 0)
+		return ret;
+
 	/* We have to initialize the device wakeup before evaluating GHID becaus=
e
 	 * doing so will notify the device if the button was used to wake the ma=
chine
 	 * from S5.
=2D-
2.39.2