Received-SPF: pass (google.com: domain of linux-kernel+bounces-128135-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Armin Wolf <W_Armin@gmx.de>
To: hdegoede@redhat.com,
	ilpo.jarvinen@linux.intel.com
Cc: corbet@lwn.net,
	sathyanarayanan.kuppuswamy@linux.intel.com,
	linux-doc@vger.kernel.org,
	platform-driver-x86@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH v2 2/4] platform/x86: xiaomi-wmi: Fix race condition when reporting key events
Date: Tue,  2 Apr 2024 16:30:57 +0200
Message-Id: <20240402143059.8456-2-W_Armin@gmx.de>
In-Reply-To: <20240402143059.8456-1-W_Armin@gmx.de>
References: <20240402143059.8456-1-W_Armin@gmx.de>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:hpZs6+gCIQk=;8nlTLCcB2sSRRih+kLDgq4cZ4Oq
 uy8cBbYWawg1CvQ57K+AvqtklCmXMOF67pk56vycDvH66m3Uzyit2xG9KXFcMksd+7BWtgSGX
 ujfjl5fbCQBNasj4PDQssiu4Qi/U6LdNEeFlAJ9POJLIiOmw2nQ9x7zY2uBgxWcX/MIRWKAug
 +bbO5degTI6eG1EmGQa83AxTZZ433e3PPfQ1BgzbdsEW14VZ5Q8XyF7k5T27q+WjoBXXKiOF+
 1aEGb9RTLpMf3lgDoklPwX0qjFDzVkeuE1Y1bgi4QZvc5s8AuCxX0IYQI1EiZeGIYyojWNRVv
 Qz3tBmu6VcWONaclHQfGj8U4Sp3grYzANE3Iw7nukl95mk+HwhOyysTGawtPD4t3mpsmjoj4P
 JKOfhiGPCbZOATdaG0tdVbUi//jEcDer87bXfEYptsYutQc0UgJ5HDaVseVn734hYHmsh/sIv
 GbAq4xHrfzKQ7+OHXRdFQ2DheqRkY0WBqgFP+JBxCvSVk9K3Dbe/VX4GDYtXuPBC4JgWvM5Hw
 sGEM/Dmy7pr+KbnihSIQuXpbiv+Pp4ALZgydNiwyeF61oS7nLloeKIW2zmnaMCmPtswE12f7g
 mL0PPyw8tj5SYJ8k90zbk945QZIjVMeKrU9li0r4WsOSbvLwdwtjD8o4qke5/sKPQTifVC15V
 PKZnMl1CQf+ghYXLSiB/gj2vceWjDaXnwY7Vz4cXpvO3312R3DD6OHRZnfiC78U3sHsDU57kD
 kB+e/0VfcYHmni9atkhO/vKPAkfGiEMt7KvncBWqzQu6Wu0TnIugYlvcIn1e3Mm5BdroEQhVU
 A7Piz1Y2EaePquVBBN3JRF+em0OLeFkbOvZKGJ6zBMw3M=

Multiple WMI events can be received concurrently, so multiple instances
of xiaomi_wmi_notify() can be active at the same time. Since the input
device is shared between those handlers, the key input sequence can be
disturbed.

Fix this by protecting the key input sequence with a mutex.

Compile-tested only.

Fixes: edb73f4f0247 ("platform/x86: wmi: add Xiaomi WMI key driver")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
 drivers/platform/x86/xiaomi-wmi.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/platform/x86/xiaomi-wmi.c b/drivers/platform/x86/xiao=
mi-wmi.c
index 1f5f108d87c0..7efbdc111803 100644
=2D-- a/drivers/platform/x86/xiaomi-wmi.c
+++ b/drivers/platform/x86/xiaomi-wmi.c
@@ -2,8 +2,10 @@
 /* WMI driver for Xiaomi Laptops */

 #include <linux/acpi.h>
+#include <linux/device.h>
 #include <linux/input.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/wmi.h>

 #include <uapi/linux/input-event-codes.h>
@@ -20,12 +22,21 @@

 struct xiaomi_wmi {
 	struct input_dev *input_dev;
+	struct mutex key_lock;	/* Protects the key event sequence */
 	unsigned int key_code;
 };

+static void xiaomi_mutex_destroy(void *data)
+{
+	struct mutex *lock =3D data;
+
+	mutex_destroy(lock);
+}
+
 static int xiaomi_wmi_probe(struct wmi_device *wdev, const void *context)
 {
 	struct xiaomi_wmi *data;
+	int ret;

 	if (wdev =3D=3D NULL || context =3D=3D NULL)
 		return -EINVAL;
@@ -35,6 +46,11 @@ static int xiaomi_wmi_probe(struct wmi_device *wdev, co=
nst void *context)
 		return -ENOMEM;
 	dev_set_drvdata(&wdev->dev, data);

+	mutex_init(&data->key_lock);
+	ret =3D devm_add_action_or_reset(&wdev->dev, xiaomi_mutex_destroy, &data=
->key_lock);
+	if (ret < 0)
+		return ret;
+
 	data->input_dev =3D devm_input_allocate_device(&wdev->dev);
 	if (data->input_dev =3D=3D NULL)
 		return -ENOMEM;
@@ -59,10 +75,12 @@ static void xiaomi_wmi_notify(struct wmi_device *wdev,=
 union acpi_object *dummy)
 	if (data =3D=3D NULL)
 		return;

+	mutex_lock(&data->key_lock);
 	input_report_key(data->input_dev, data->key_code, 1);
 	input_sync(data->input_dev);
 	input_report_key(data->input_dev, data->key_code, 0);
 	input_sync(data->input_dev);
+	mutex_unlock(&data->key_lock);
 }

 static const struct wmi_device_id xiaomi_wmi_id_table[] =3D {
=2D-
2.39.2