Commit d1883cef authored by Hans de Goede's avatar Hans de Goede Committed by Lee Jones
Browse files

leds: led-class: Only Add LED to leds_list when it is fully ready 



Before this change the LED was added to leds_list before led_init_core()
gets called adding it the list before led_classdev.set_brightness_work gets
initialized.

This leaves a window where led_trigger_register() of a LED's default
trigger will call led_trigger_set() which calls led_set_brightness()
which in turn will end up queueing the *uninitialized*
led_classdev.set_brightness_work.

This race gets hit by the lenovo-thinkpad-t14s EC driver which registers
2 LEDs with a default trigger provided by snd_ctl_led.ko in quick
succession. The first led_classdev_register() causes an async modprobe of
snd_ctl_led to run and that async modprobe manages to exactly hit
the window where the second LED is on the leds_list without led_init_core()
being called for it, resulting in:

 ------------[ cut here ]------------
 WARNING: CPU: 11 PID: 5608 at kernel/workqueue.c:4234 __flush_work+0x344/0x390
 Hardware name: LENOVO 21N2S01F0B/21N2S01F0B, BIOS N42ET93W (2.23 ) 09/01/2025
 ...
 Call trace:
  __flush_work+0x344/0x390 (P)
  flush_work+0x2c/0x50
  led_trigger_set+0x1c8/0x340
  led_trigger_register+0x17c/0x1c0
  led_trigger_register_simple+0x84/0xe8
  snd_ctl_led_init+0x40/0xf88 [snd_ctl_led]
  do_one_initcall+0x5c/0x318
  do_init_module+0x9c/0x2b8
  load_module+0x7e0/0x998

Close the race window by moving the adding of the LED to leds_list to
after the led_init_core() call.

Cc: stable@vger.kernel.org
Fixes: d23a22a7 ("leds: delay led_set_brightness if stopping soft-blink")
Signed-off-by: default avatarHans de Goede <johannes.goede@oss.qualcomm.com>
Reviewed-by: default avatarSebastian Reichel <sre@kernel.org>
Link: https://patch.msgid.link/20251211163727.366441-1-johannes.goede@oss.qualcomm.com


Signed-off-by: default avatarLee Jones <lee@kernel.org>
parent 8f0b4cce

drivers/leds/led-class.c

+5 −5
Original line number Diff line number Diff line
@@ -560,11 +560,6 @@ int led_classdev_register_ext(struct device *parent, 
#ifdef CONFIG_LEDS_BRIGHTNESS_HW_CHANGED

	led_cdev->brightness_hw_changed = -1;

#endif

	/* add to the list of leds */

	down_write(&leds_list_lock);

	list_add_tail(&led_cdev->node, &leds_list);

	up_write(&leds_list_lock);



	if (!led_cdev->max_brightness)

		led_cdev->max_brightness = LED_FULL;
@@ -574,6 +569,11 @@ int led_classdev_register_ext(struct device *parent, 


	led_init_core(led_cdev);



	/* add to the list of leds */

	down_write(&leds_list_lock);

	list_add_tail(&led_cdev->node, &leds_list);

	up_write(&leds_list_lock);



#ifdef CONFIG_LEDS_TRIGGERS

	led_trigger_set_default(led_cdev);

#endif