mirror of https://github.com/torvalds/linux.git
d1883cefd3
Before this change the LED was added to leds_list before led_init_core()
gets called adding it the list before led_classdev.set_brightness_work gets
initialized.
This leaves a window where led_trigger_register() of a LED's default
trigger will call led_trigger_set() which calls led_set_brightness()
which in turn will end up queueing the *uninitialized*
led_classdev.set_brightness_work.
This race gets hit by the lenovo-thinkpad-t14s EC driver which registers
2 LEDs with a default trigger provided by snd_ctl_led.ko in quick
succession. The first led_classdev_register() causes an async modprobe of
snd_ctl_led to run and that async modprobe manages to exactly hit
the window where the second LED is on the leds_list without led_init_core()
being called for it, resulting in:
------------[ cut here ]------------
WARNING: CPU: 11 PID: 5608 at kernel/workqueue.c:4234 __flush_work+0x344/0x390
Hardware name: LENOVO 21N2S01F0B/21N2S01F0B, BIOS N42ET93W (2.23 ) 09/01/2025
...
Call trace:
__flush_work+0x344/0x390 (P)
flush_work+0x2c/0x50
led_trigger_set+0x1c8/0x340
led_trigger_register+0x17c/0x1c0
led_trigger_register_simple+0x84/0xe8
snd_ctl_led_init+0x40/0xf88 [snd_ctl_led]
do_one_initcall+0x5c/0x318
do_init_module+0x9c/0x2b8
load_module+0x7e0/0x998
Close the race window by moving the adding of the LED to leds_list to
after the led_init_core() call.
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| blink | ||
| flash | ||
| rgb | ||
| simatic | ||
| trigger | ||
| .kunitconfig | ||
| Kconfig | ||
| Makefile | ||
| TODO | ||
| led-class-flash.c | ||
| led-class-multicolor.c | ||
| led-class.c | ||
| led-core.c | ||
| led-test.c | ||
| led-triggers.c | ||
| leds-88pm860x.c | ||
| leds-acer-a500.c | ||
| leds-adp5520.c | ||
| leds-an30259a.c | ||
| leds-apu.c | ||
| leds-ariel.c | ||
| leds-aw200xx.c | ||
| leds-aw2013.c | ||
| leds-bcm6328.c | ||
| leds-bcm6358.c | ||
| leds-bd2606mvv.c | ||
| leds-bd2802.c | ||
| leds-blinkm.c | ||
| leds-cht-wcove.c | ||
| leds-clevo-mail.c | ||
| leds-cobalt-qube.c | ||
| leds-cobalt-raq.c | ||
| leds-cpcap.c | ||
| leds-cr0014114.c | ||
| leds-cros_ec.c | ||
| leds-da903x.c | ||
| leds-da9052.c | ||
| leds-dac124s085.c | ||
| leds-el15203000.c | ||
| leds-expresswire.c | ||
| leds-gpio-register.c | ||
| leds-gpio.c | ||
| leds-hp6xx.c | ||
| leds-ip30.c | ||
| leds-ipaq-micro.c | ||
| leds-is31fl32xx.c | ||
| leds-is31fl319x.c | ||
| leds-lm355x.c | ||
| leds-lm3530.c | ||
| leds-lm3532.c | ||
| leds-lm3533.c | ||
| leds-lm3642.c | ||
| leds-lm3692x.c | ||
| leds-lm3697.c | ||
| leds-lm36274.c | ||
| leds-locomo.c | ||
| leds-lp50xx.c | ||
| leds-lp55xx-common.c | ||
| leds-lp55xx-common.h | ||
| leds-lp3944.c | ||
| leds-lp3952.c | ||
| leds-lp5521.c | ||
| leds-lp5523.c | ||
| leds-lp5562.c | ||
| leds-lp5569.c | ||
| leds-lp8501.c | ||
| leds-lp8788.c | ||
| leds-lp8860.c | ||
| leds-lp8864.c | ||
| leds-lt3593.c | ||
| leds-max5970.c | ||
| leds-max8997.c | ||
| leds-max77650.c | ||
| leds-max77705.c | ||
| leds-mc13783.c | ||
| leds-menf21bmc.c | ||
| leds-mlxcpld.c | ||
| leds-mlxreg.c | ||
| leds-mt6323.c | ||
| leds-net48xx.c | ||
| leds-netxbig.c | ||
| leds-nic78bx.c | ||
| leds-ns2.c | ||
| leds-ot200.c | ||
| leds-pca955x.c | ||
| leds-pca963x.c | ||
| leds-pca995x.c | ||
| leds-pca9532.c | ||
| leds-pm8058.c | ||
| leds-powernv.c | ||
| leds-pwm.c | ||
| leds-qnap-mcu.c | ||
| leds-rb532.c | ||
| leds-regulator.c | ||
| leds-sc27xx-bltc.c | ||
| leds-spi-byte.c | ||
| leds-ss4200.c | ||
| leds-st1202.c | ||
| leds-sun50i-a100.c | ||
| leds-sunfire.c | ||
| leds-syscon.c | ||
| leds-tca6507.c | ||
| leds-ti-lmu-common.c | ||
| leds-tlc591xx.c | ||
| leds-tps6105x.c | ||
| leds-turris-omnia.c | ||
| leds-upboard.c | ||
| leds-wm831x-status.c | ||
| leds-wm8350.c | ||
| leds-wrap.c | ||
| leds.h | ||
| uleds.c | ||