Received-SPF: pass (google.com: domain of linux-kernel+bounces-122270-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
From: Armin Wolf <W_Armin@gmx.de>
To: hdegoede@redhat.com,
	ilpo.jarvinen@linux.intel.com
Cc: corbet@lwn.net,
	linux-doc@vger.kernel.org,
	platform-driver-x86@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH 2/4] platform/x86: xiaomi-wmi: Fix race condition when reporting key events
Date: Thu, 28 Mar 2024 02:23:34 +0100
Message-Id: <20240328012336.145612-2-W_Armin@gmx.de>
In-Reply-To: <20240328012336.145612-1-W_Armin@gmx.de>
References: <20240328012336.145612-1-W_Armin@gmx.de>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:N3a+WBUAfuI=;DQFi2oA2gGx5hW6YjsguGd5cBhD
 kGrEUOTht/4Sd/IBm7PHjCYDNZ+u/404pbhtC0DQ/N0JrPn0jvdXY31rwCpNryR17TG6kXO3K
 Nl69j7LxnZjV+GeCp21AxyaB5MyM+wpz3mJCBw0NXtLGn3XUNHZ/MZlv8cbNDUVx4GzfhUnwJ
 Q7LpWhiIEUgVvV76enUVkNDGmShHM3oeHkiO7LlWjbOgfWPhee5oBXGSDZLviDsN9JzSphzw8
 9dbxQhMoUpfrNu4h3VAFenD4UkwZhk0CkwAw/vvYKeT028xxlj4vU2Q3Q4E8UuJZ8xAyRvSLN
 y2GMqlUbVqPRpVM78rgWtssXv92UuOVXs4H83It0CZzznJVIhQbSCEYmBuvjCi8vKK5fvD4Gi
 o2c2tNydLRq+fhNYpFdM0XecBGY+0qQnlmhSq8h4gV0a+mM5p45vFKPbAkUt8a9CAUQ2OweFE
 CHZ9PeH195lqa4hmwd8QCCSRFgfLSsPR8OVJLLldxE7/aSnzKcf57j01N/UXXQhqtZRA1Rpj6
 sySpXt0vub33UgqA/OcYs5MBocK8cPtQ25BDeEH1K6SLSxXtxY54SasHN5yx5v3Abf+f8pCni
 xZkYJFzZ4KHkXNhw3XhWRlKI9oAU2ywL6Er0m2i8/baWePOz2bwHPkokcEsD/SzS1ESq1ANDb
 RgQ581gQIc89iREbw6o2BjLhloH5VXQDN+nooyDVgdpJ3anAwAKOkaTNGbv2dAa13qklzcWfR
 KpTxKy2605qeiQ3F54JkFxfMr752PLcWzfbRLB6NJJKpt/45OvXuxyEYlC2TFQ/z2fN9KZsJ4
 yDZx9gIhWVwSnIcGMjDu55ViKXHuAuIiK9oAaRMiVljtU=

Multiple WMI events can be received concurrently, so multiple instances
of xiaomi_wmi_notify() can be active at the same time. Since the input
device is shared between those handlers, the key input sequence can be
disturbed.

Fix this by protecting the key input sequence with a mutex.

Compile-tested only.

Fixes: edb73f4f0247 ("platform/x86: wmi: add Xiaomi WMI key driver")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
 drivers/platform/x86/xiaomi-wmi.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/platform/x86/xiaomi-wmi.c b/drivers/platform/x86/xiao=
mi-wmi.c
index 1f5f108d87c0..7efbdc111803 100644
=2D-- a/drivers/platform/x86/xiaomi-wmi.c
+++ b/drivers/platform/x86/xiaomi-wmi.c
@@ -2,8 +2,10 @@
 /* WMI driver for Xiaomi Laptops */

 #include <linux/acpi.h>
+#include <linux/device.h>
 #include <linux/input.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/wmi.h>

 #include <uapi/linux/input-event-codes.h>
@@ -20,12 +22,21 @@

 struct xiaomi_wmi {
 	struct input_dev *input_dev;
+	struct mutex key_lock;	/* Protects the key event sequence */
 	unsigned int key_code;
 };

+static void xiaomi_mutex_destroy(void *data)
+{
+	struct mutex *lock =3D data;
+
+	mutex_destroy(lock);
+}
+
 static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context)
 {
 	struct xiaomi_wmi *data;
+	int ret;

 	if (wdev =3D=3D NULL || context =3D=3D NULL)
 		return -EINVAL;
@@ -35,6 +46,11 @@ static int xiaomi_wmi_probe(struct wmi_device *wdev, co=
nst void *context)
 		return -ENOMEM;
 	dev_set_drvdata(&wdev->dev, data);

+	mutex_init(&data->key_lock);
+	ret =3D devm_add_action_or_reset(&wdev->dev, xiaomi_mutex_destroy, &data=
->key_lock);
+	if (ret < 0)
+		return ret;
+
 	data->input_dev =3D devm_input_allocate_device(&wdev->dev);
 	if (data->input_dev =3D=3D NULL)
 		return -ENOMEM;
@@ -59,10 +75,12 @@ static void xiaomi_wmi_notify(struct wmi_device *wdev,=
 union acpi_object *dummy)
 	if (data =3D=3D NULL)
 		return;

+	mutex_lock(&data->key_lock);
 	input_report_key(data->input_dev, data->key_code, 1);
 	input_sync(data->input_dev);
 	input_report_key(data->input_dev, data->key_code, 0);
 	input_sync(data->input_dev);
+	mutex_unlock(&data->key_lock);
 }

 static const struct wmi_device_id xiaomi_wmi_id_table[] =3D {
=2D-
2.39.2