From nobody Tue Jun 16 12:47:47 2026 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1CBB22C326C for ; Mon, 20 Apr 2026 05:13:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776662016; cv=none; b=dKS4KvZgq9RbGuok208hx1Xagk/8yBErGXmqprnS353OQE+lvQDAsFLs+QPlMunX4Ji/dcSyah62vN2nvfxhEY5YIao5C7TXyrVkuvuRdgvEno9yhumfjIRK9XZDHBBiiwW+Br5UdGlGsdJw4jpbDrTLir05eODe+IdfRWVaisk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776662016; c=relaxed/simple; bh=Itt2y7GTnHVJrFtAaPeXswkX8rW4RyB7vpTnRm0B4uU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=qyUR+ky7eTsRah+Vj3rambmCYD2jOLPTLw1iaM9BIq5JPKC+uRek9yU2g8NLo/OK/JZEbaWrEfqAv27oyrgTlShyx3nk2F4uZVzqXt8hK5kGia6Cbt0gm6udCoOzfC7UugiH2xodAZzE9TuhjFgaHToaHxdPhyQXuw+ZYquKdeQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=snu.ac.kr; spf=pass smtp.mailfrom=snu.ac.kr; dkim=pass (1024-bit key) header.d=snu.ac.kr header.i=@snu.ac.kr header.b=WEPV4znX; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=snu.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=snu.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=snu.ac.kr header.i=@snu.ac.kr header.b="WEPV4znX" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-35da9c0c007so2522982a91.2 for ; Sun, 19 Apr 2026 22:13:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=snu.ac.kr; s=google; t=1776662013; x=1777266813; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=panaAxBG+Oj8O67g22hba7g+kj4UgFC78OIsOhVGnTk=; b=WEPV4znXk5QBV4avjqTQ+t11JCv0KYVG8TWzjgKFwzJc7HiS+VYJ3KJDeyA03iSUbz bkKhucH/gH7dFD4ytiP1q36T3Om1jvW6J73PWaNtFiEOfwcNd7+cnGIwlKHPCkRt3Rti +2fqnSjxLJqSqE2XD3DCEq7XnrCpnpb1pttTA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776662013; x=1777266813; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=panaAxBG+Oj8O67g22hba7g+kj4UgFC78OIsOhVGnTk=; b=CGUBdMPNi1bDJ3hw51h8df3sCSZYUGty6mhb7GBKk7DlgKgykuPCDDdsXp6tOAcyWw e7HceU1yoar4Y1EHwJnk4lPadQZ9A7zabxzdKS8EN5z2eAAlc0X4De6hcz7g9vToxcCd 3hzEFBQ5DGLfO57NiWpqIOkZRtriE+casolF9LRVJzEj1fxw0KyE8eLOPhUdYEyuFGMK ZAw+qpkUw7jgFpRl37Y49ZWYhZVTFn2RsCsOm9Z76kPBQVexhkjWhdYz4uYpeX+YytcP 4kAFUwxWQjRlONNidpd1lHMjvUot9GUvJW2Vg6luzoZR6ZAaszbkpTncu3KzMG3dKJ32 B/Tw== X-Forwarded-Encrypted: i=1; AFNElJ+3hTidYbO57ysIfNJEkx6DTRLJ0nc5DNS3rXzbO60+8O2V24ZpVhvCI3MaiO5b4xKdhqheOBOV6Oo5VB4=@vger.kernel.org X-Gm-Message-State: AOJu0Yw7/eKLDidoFfxWSedgXhL1ruGx8yMclBfOTHkbxfZX6+IccC+T qWqVOyin7TuGrugtY89kqNGaRQqU1PAdoXFLrQDXFae232riQu8bhdUZPc/TxGsGW/E= X-Gm-Gg: AeBDiet5H3BAzXN41ZzBc+05hlvbvkFHmseh/cb9OiK5UiAXaJ5gyxhOZKeUCg0xO9m MRmxjukU0u8zLdZ0DP1yMwHQQC9o0eq4Y36aEQ0hOW6JYeNdzgx0fmZg5Rm27q1PGRTeboSESVP oO2FvC3H68xfdqRLqf4TOWQrlnl6SehI68seXwDEd87LmwFdk0FEtKgIp5EWFZRT7RZkoUzV8es fLRwbzOx3AanJVZgH4U5RCkXfFyv7Dnwf3NNNQy04uXX12o1pSIjiYpH/ja2yA9+UijKtQKhKFp fVHNKQDXiNgJr4UJXRyEBa3gDVjwKSf4nRnyvbfdffwVTppO1s3X2ZzTZ8o89xiQjGGlJ+RRBEt a8NYjHqBxHMRp6UFKKCwBK5B4x6fDyodGQW3EcIUf9dFRZ+aG3clAWyqhkDhr0D2CnsXQ4vn2rr 8aZWt4kZjdj2BPuz/8JZ4Ix7QE643/0zh0I62rTNHS/Jw159QzVixz8X/pGbJXUfXKb2B1iw== X-Received: by 2002:a17:90b:5106:b0:35d:93ff:2855 with SMTP id 98e67ed59e1d1-361403e159amr11563269a91.8.1776662013426; Sun, 19 Apr 2026 22:13:33 -0700 (PDT) Received: from nunu.. (nunu.snu.ac.kr. [147.46.112.82]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3614186a52csm11032591a91.4.2026.04.19.22.13.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 19 Apr 2026 22:13:33 -0700 (PDT) From: Sangyun Kim To: jikos@kernel.org, bentiss@kernel.org Cc: qasdev00@gmail.com, gargaditya08@live.com, linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 1/2] HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Date: Mon, 20 Apr 2026 14:13:17 +0900 Message-Id: <20260420051318.1411671-2-sangyun.kim@snu.ac.kr> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260420051318.1411671-1-sangyun.kim@snu.ac.kr> References: <20260420051318.1411671-1-sangyun.kim@snu.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Commit 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to both the probe close_hw error path and appletb_kbd_remove(), but the way it was wired in left the inactivity timer reachable during driver tear-down via two distinct windows. Window A -- put_device() before timer_delete_sync(): put_device(&kbd->backlight_dev->dev); timer_delete_sync(&kbd->inactivity_timer); The inactivity_timer softirq reads kbd->backlight_dev and calls backlight_device_set_brightness() -> mutex_lock(&ops_lock). If a concurrent hid_appletb_bl unbind drops the last devm reference between these two calls, the backlight_device is freed and the mutex_lock() touches freed memory. Window B -- backlight cleanup before hid_hw_stop(): if (kbd->backlight_dev) { timer_delete_sync(...); put_device(...); } hid_hw_close(hdev); hid_hw_stop(hdev); Even after Window A is closed, hid_hw_close()/hid_hw_stop() still run afterwards, so a late ".event" callback from the HID core (USB URB completion on real Apple hardware) can arrive after timer_delete_sync() drained the softirq but before put_device() drops the reference. That callback reaches reset_inactivity_timer(), which calls mod_timer() and re-arms the timer. The freshly re-armed timer can then fire on the about-to-be-freed backlight_device. Both windows produce the same KASAN slab-use-after-free: BUG: KASAN: slab-use-after-free in __mutex_lock+0x1aab/0x21c0 Read of size 8 at addr ffff88803ee9a108 by task swapper/0/0 Call Trace: __mutex_lock backlight_device_set_brightness appletb_inactivity_timer call_timer_fn run_timer_softirq handle_softirqs Allocated by task N: devm_backlight_device_register appletb_bl_probe Freed by task M: (concurrent hid_appletb_bl unbind path) Close both windows at once by reworking the tear-down in appletb_kbd_remove() and in the probe close_hw error path so that 1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup, guaranteeing no further .event callback can fire and re-arm the timer, and 2) inside the "if (kbd->backlight_dev)" block, timer_delete_sync() runs before put_device(), so the softirq is drained before the final reference is dropped. Fixes: 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appl= etb_kbd_probe") Cc: stable@vger.kernel.org Signed-off-by: Sangyun Kim --- drivers/hid/hid-appletb-kbd.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/hid/hid-appletb-kbd.c b/drivers/hid/hid-appletb-kbd.c index 0fdc0968b9ef..8feac9e3589b 100644 --- a/drivers/hid/hid-appletb-kbd.c +++ b/drivers/hid/hid-appletb-kbd.c @@ -440,13 +440,13 @@ static int appletb_kbd_probe(struct hid_device *hdev,= const struct hid_device_id unregister_handler: input_unregister_handler(&kbd->inp_handler); close_hw: - if (kbd->backlight_dev) { - put_device(&kbd->backlight_dev->dev); - timer_delete_sync(&kbd->inactivity_timer); - } hid_hw_close(hdev); stop_hw: hid_hw_stop(hdev); + if (kbd->backlight_dev) { + timer_delete_sync(&kbd->inactivity_timer); + put_device(&kbd->backlight_dev->dev); + } return ret; } =20 @@ -457,13 +457,13 @@ static void appletb_kbd_remove(struct hid_device *hde= v) appletb_kbd_set_mode(kbd, APPLETB_KBD_MODE_OFF); =20 input_unregister_handler(&kbd->inp_handler); + hid_hw_close(hdev); + hid_hw_stop(hdev); + if (kbd->backlight_dev) { - put_device(&kbd->backlight_dev->dev); timer_delete_sync(&kbd->inactivity_timer); + put_device(&kbd->backlight_dev->dev); } - - hid_hw_close(hdev); - hid_hw_stop(hdev); } =20 static int appletb_kbd_suspend(struct hid_device *hdev, pm_message_t msg) --=20 2.34.1 From nobody Tue Jun 16 12:47:47 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B017B37F75E for ; Mon, 20 Apr 2026 05:13:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776662018; cv=none; b=ettqgJawYCfnjQ8pb2/5aknfouo4WHA/NXujvgKU6/wGrnBeTwHzgZYoFfDr7ze1JL9sTQk0V5YC+88/ZbyJPOK3SQa1ChfvvS1TTQq7yEmoWaWjP12X4CcUEOfwWQVveuAYCWZr2nnSfVTgT0geBu8iZts/mwU3RN02KLPpHx0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776662018; c=relaxed/simple; bh=01XNhHkfueCJ1FLR+EHojwXfn62aRxo9vj4McCxGw5k=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=F8C3JDtVaKv2XqE+zGFZs4QoGqNXwuQGJAMhrA5kkdiGhjRy8poeNrAJ5FBqH5hwNKFMZuB3hqlq5kVKVvNnkE9+l2nlnYHkIXCCNmGwasB76adU3QAtZbEFjjryl3KI89ShdCW7DuT7cerHaOElRn/Ue2HQaPc4LQhvCaCsnj4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=snu.ac.kr; spf=pass smtp.mailfrom=snu.ac.kr; dkim=pass (1024-bit key) header.d=snu.ac.kr header.i=@snu.ac.kr header.b=HuMfC8Sb; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=snu.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=snu.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=snu.ac.kr header.i=@snu.ac.kr header.b="HuMfC8Sb" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-35da1af3e10so2552405a91.3 for ; Sun, 19 Apr 2026 22:13:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=snu.ac.kr; s=google; t=1776662016; x=1777266816; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ihcvVaBfQ28dquD5a+undc5jBXoT8T5VO4GMetOrvw0=; b=HuMfC8Sb6MUTOKhVtSxg1rTxT1Na0uAILTOuiS0j6Trhjwa15yfIW24PGflLcc5PPH mVs0dz9ib6An92AkW6I/NwzHw2HnPddAFafV6xF5r62UL9atJ6nRznT1vYBnCgSpS/CQ W4PAl2jldLE+jEcGTDc6KihXrOIKf3iN9ITFs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776662016; x=1777266816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=ihcvVaBfQ28dquD5a+undc5jBXoT8T5VO4GMetOrvw0=; b=EXjqQB+BMXtx4xuC8lyumml7Frf0IJiDIyhWpfjk3WlMrnC8+YixooFEohcPDhEoTt wnF5uNmxeuRCeniQl31PloZZhiEObzZ8hUIycp+nQ1LW2wknafnoDCmJWQ95JYrZYQ1i 3udtaFQDkbsvY7gkUSgd7hzXMiAPCcVQYfWkSLw2JpvQ7GSiSZKPnO8VXWR0c1PW4ijb BQnEWPOwCqNvVombNLciZSYZnVYc0ImrgHoXIIim3eDXxy+xyBCMGAigw2WAzsLBC1bA 9oxsxZVuw2HfUTuWv6pugbiAxzUdiPq0jq3FzBc7emscB9s/uKZXmMxHl5E//r3vpeby r4Mw== X-Forwarded-Encrypted: i=1; AFNElJ/NlbdAbqPMxxFsJyWBCmYqJdKUBZ8IyvEE9I9FYie7npmN8fiSLtnN4GYVB0bedcixxLA5LBBEoNfPJZk=@vger.kernel.org X-Gm-Message-State: AOJu0YyUFhmDfvadiiZ7osr57pyzYUEXOTrKpmltGi4QCWJ1BhFj7Rm1 LGHkry18N2XBMe4e7h6ygYqDW5e50+TGMROFUG9zoFcE14mVZM69jKHS7ILtfjw2g+w= X-Gm-Gg: AeBDiet4zT+1FZrA554rA7ZRcAI0mwnH0/ro7C2tQlJX6FTVrC4fhLnSTrLUI07Njf3 rQUoJpOXAW7MFwjPmAkUPONyeQmC+bLSUia7vCNsIHT+c3w3ftuHbE5yzdTy0nLbRU352EhyLPm 9IvR5u6pzlKRjwO+MW0kzsF8zvlELem8TzekDhvghtWsbvd+EiVsffyL4lcWiXFGRmpeQ/cd4gp tCASZgFSnwmhtbCf/KNtAxNfeaiNUsdjQ3nafBpT91VTIUyuQYxpL0FQij4b4qEWRO5wb7kY3DJ CIH7bABC/drA4P/phrYbwnddDmFfh35hQmSMQn/7ZU3ePUJrcqm64ylUxJCLUkNDlTSk8+DtUQe y6q77TH0MZOQN5GgkDcVqe9xRXLL0IUzXff99FHvc5L6MHT7bsXzaaJMKBjRFgFbXl/n1Y4v/vA rihghWDJTGzRdwGxs74wuaviMOpWPyQaJiIPG20iNCktxHQwLy2H7+A3pdofdH22jP07SzgQ== X-Received: by 2002:a17:90b:5865:b0:35e:27ec:dea with SMTP id 98e67ed59e1d1-36140493410mr13257104a91.23.1776662016114; Sun, 19 Apr 2026 22:13:36 -0700 (PDT) Received: from nunu.. (nunu.snu.ac.kr. [147.46.112.82]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3614186a52csm11032591a91.4.2026.04.19.22.13.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 19 Apr 2026 22:13:35 -0700 (PDT) From: Sangyun Kim To: jikos@kernel.org, bentiss@kernel.org Cc: qasdev00@gmail.com, gargaditya08@live.com, linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 2/2] HID: appletb-kbd: run inactivity autodim from workqueues Date: Mon, 20 Apr 2026 14:13:18 +0900 Message-Id: <20260420051318.1411671-3-sangyun.kim@snu.ac.kr> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260420051318.1411671-1-sangyun.kim@snu.ac.kr> References: <20260420051318.1411671-1-sangyun.kim@snu.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The autodim code in hid-appletb-kbd takes backlight_device->ops_lock via backlight_device_set_brightness() -> mutex_lock() from two different atomic contexts: * appletb_inactivity_timer() is a struct timer_list callback, so it runs in softirq context. Every expiry triggers BUG: sleeping function called from invalid context at kernel/locking/m= utex.c:591 Call Trace: __might_resched __mutex_lock backlight_device_set_brightness appletb_inactivity_timer call_timer_fn run_timer_softirq * reset_inactivity_timer() is called from appletb_kbd_hid_event() and appletb_kbd_inp_event(). On real USB hardware these run in softirq/IRQ context (URB completion and input-event dispatch). When the Touch Bar has already been dimmed or turned off, the reset path calls backlight_device_set_brightness() directly to restore brightness, producing the same warning. Both call sites hit the same mutex_lock()-from-atomic bug. Fix them together by moving the blocking work onto the system workqueue: * Convert the inactivity timer from struct timer_list to struct delayed_work; the callback (appletb_inactivity_work) now runs in process context where mutex_lock() is legal. * Add a dedicated struct work_struct restore_brightness_work and have reset_inactivity_timer() schedule it instead of calling backlight_device_set_brightness() directly. Cancel both works synchronously during driver tear-down alongside the existing backlight reference drop. The semantics are unchanged (same delays, same state transitions on dim, turn-off and user activity); only the execution context of the sleeping call changes. The timer field and callback are renamed to match their new type; reset_inactivity_timer() keeps its name because it is invoked from input event paths that read naturally as "reset the inactivity timer". Fixes: 93a0fc489481 ("HID: hid-appletb-kbd: add support for automatic brigh= tness control while using the touchbar") Cc: stable@vger.kernel.org Signed-off-by: Sangyun Kim --- drivers/hid/hid-appletb-kbd.c | 44 ++++++++++++++++++++++++----------- 1 file changed, 30 insertions(+), 14 deletions(-) diff --git a/drivers/hid/hid-appletb-kbd.c b/drivers/hid/hid-appletb-kbd.c index 8feac9e3589b..462010a75899 100644 --- a/drivers/hid/hid-appletb-kbd.c +++ b/drivers/hid/hid-appletb-kbd.c @@ -17,7 +17,7 @@ #include #include #include -#include +#include #include =20 #include "hid-ids.h" @@ -62,7 +62,8 @@ struct appletb_kbd { struct input_handle kbd_handle; struct input_handle tpd_handle; struct backlight_device *backlight_dev; - struct timer_list inactivity_timer; + struct delayed_work inactivity_work; + struct work_struct restore_brightness_work; bool has_dimmed; bool has_turned_off; u8 saved_mode; @@ -164,16 +165,18 @@ static int appletb_tb_key_to_slot(unsigned int code) } } =20 -static void appletb_inactivity_timer(struct timer_list *t) +static void appletb_inactivity_work(struct work_struct *work) { - struct appletb_kbd *kbd =3D timer_container_of(kbd, t, inactivity_timer); + struct appletb_kbd *kbd =3D container_of(to_delayed_work(work), + struct appletb_kbd, + inactivity_work); =20 if (kbd->backlight_dev && appletb_tb_autodim) { if (!kbd->has_dimmed) { backlight_device_set_brightness(kbd->backlight_dev, 1); kbd->has_dimmed =3D true; - mod_timer(&kbd->inactivity_timer, - jiffies + secs_to_jiffies(appletb_tb_idle_timeout)); + mod_delayed_work(system_wq, &kbd->inactivity_work, + secs_to_jiffies(appletb_tb_idle_timeout)); } else if (!kbd->has_turned_off) { backlight_device_set_brightness(kbd->backlight_dev, 0); kbd->has_turned_off =3D true; @@ -181,16 +184,25 @@ static void appletb_inactivity_timer(struct timer_lis= t *t) } } =20 +static void appletb_restore_brightness_work(struct work_struct *work) +{ + struct appletb_kbd *kbd =3D container_of(work, struct appletb_kbd, + restore_brightness_work); + + if (kbd->backlight_dev) + backlight_device_set_brightness(kbd->backlight_dev, 2); +} + static void reset_inactivity_timer(struct appletb_kbd *kbd) { if (kbd->backlight_dev && appletb_tb_autodim) { if (kbd->has_dimmed || kbd->has_turned_off) { - backlight_device_set_brightness(kbd->backlight_dev, 2); kbd->has_dimmed =3D false; kbd->has_turned_off =3D false; + schedule_work(&kbd->restore_brightness_work); } - mod_timer(&kbd->inactivity_timer, - jiffies + secs_to_jiffies(appletb_tb_dim_timeout)); + mod_delayed_work(system_wq, &kbd->inactivity_work, + secs_to_jiffies(appletb_tb_dim_timeout)); } } =20 @@ -408,9 +420,11 @@ static int appletb_kbd_probe(struct hid_device *hdev, = const struct hid_device_id dev_err_probe(dev, -ENODEV, "Failed to get backlight device\n"); } else { backlight_device_set_brightness(kbd->backlight_dev, 2); - timer_setup(&kbd->inactivity_timer, appletb_inactivity_timer, 0); - mod_timer(&kbd->inactivity_timer, - jiffies + secs_to_jiffies(appletb_tb_dim_timeout)); + INIT_DELAYED_WORK(&kbd->inactivity_work, appletb_inactivity_work); + INIT_WORK(&kbd->restore_brightness_work, + appletb_restore_brightness_work); + mod_delayed_work(system_wq, &kbd->inactivity_work, + secs_to_jiffies(appletb_tb_dim_timeout)); } =20 kbd->inp_handler.event =3D appletb_kbd_inp_event; @@ -444,7 +458,8 @@ static int appletb_kbd_probe(struct hid_device *hdev, c= onst struct hid_device_id stop_hw: hid_hw_stop(hdev); if (kbd->backlight_dev) { - timer_delete_sync(&kbd->inactivity_timer); + cancel_delayed_work_sync(&kbd->inactivity_work); + cancel_work_sync(&kbd->restore_brightness_work); put_device(&kbd->backlight_dev->dev); } return ret; @@ -461,7 +476,8 @@ static void appletb_kbd_remove(struct hid_device *hdev) hid_hw_stop(hdev); =20 if (kbd->backlight_dev) { - timer_delete_sync(&kbd->inactivity_timer); + cancel_delayed_work_sync(&kbd->inactivity_work); + cancel_work_sync(&kbd->restore_brightness_work); put_device(&kbd->backlight_dev->dev); } } --=20 2.34.1