From nobody Mon Jun 8 05:26:23 2026 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 988493845A6 for ; Fri, 5 Jun 2026 17:50:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780681828; cv=none; b=dNxKQVMxnoHPvQ6ytfCpR696MTiH3X66zBpzm5XpAbXdZk42bTsyUPvhnncah5wpG/+PL0YMXuHw3uiA3dh8txZWNs+EO20Yw7t5/aMKpQs2YcEbp8wtMf1xBd1K6MbmcqU73c0OCwkdC4qeCeQlWWLl+HN96Zdm++lBrUEQ1QA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780681828; c=relaxed/simple; bh=E9w6f0xrSSYtvlb3ya5JkD8VpRPp9n43dUx3ws1rFiU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EnFj2+uOcnMWEx/M0WJUGLLkP743lCaAQstoNv3uWgWKXs4j/D3GjwujdvMfXZ6Pt4JD7Lc4zcleLEtxSGA480bS9pfY7YQXvItRecDFeon5xjXQpsseWP5Q+r86iJZZUsj9Y6wc346suD/npWvv3rw1VyXeMyVgQpF8l8BgGzE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gLlVXV6c; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gLlVXV6c" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2c0bd02d97eso26025455ad.2 for ; Fri, 05 Jun 2026 10:50:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780681823; x=1781286623; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=RU4D9IDGoqS0yzp32EWwU+AQX5TFq61qrIjDkY+Qek4=; b=gLlVXV6c95bOMrlsjbY7/5I3X4KkpLbBBz4n94WaZgTPXvQYjhWnrfmwFIa8ZRzTEI GnPAzXNNuR5e9q7h78XH4dIQwE12iuh2bMBCuyreYAk+IZGyTQ5pES88KI37aKfFEQFV BUDa8QMgqiSnoY7tcqWcNnWgbbCJxF5gYJFzmt0Um54WH3F7Pea96HfTDPlfAAJk0lra 6d6oHfKTlX8X3gVNRPzrtgLopK/1iW7jQuqP5VrnVn3c/xwlWvoswyPiG8Q4N6qyjA2c OZDKJEtMRgUtcZxlHDq42QVbuua9/Rfe9NGxbWHJIZxX+UPOVmgC5FBhim56ZpyAY06A Ngjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780681823; x=1781286623; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=RU4D9IDGoqS0yzp32EWwU+AQX5TFq61qrIjDkY+Qek4=; b=EKb1m/sGfB/GFW3PfENP8sSx1214LS8HbajDoAMCpAmI67ifcHXNvi1wOvyokpBOMT Ud+kbyV0hxfXlMHaDrX93q+GBRXZh/a0e8pgoaNbWLfVtLwZTbogR+7z8nO6ZcpiSZ0K xPEE5CewbU3uzCo9AHI+BZGL8EU740svcAX8ldh9LHOo8cvj40IbEJ04ld4M+9NWMOSm +gWYDtlUTXdmd67E9igQr+Oy3Iy3LMOqFSUHo9l9X4IdDTXzGQxW5JYRypZ0B2z6N7U+ 1LS+drl2yqsXO+R8JnaiBp6zALvVHt2G3eNzn/PvmyUAOxhz9rxzH7XgG5TVIcW6UcuO VVmg== X-Forwarded-Encrypted: i=1; AFNElJ9p0oszpoCzaPpuxiNh4+xFYc6ytlhqMDQhBYvr2rSwbFaChEtkYgQ8HjGyuuBwF9aweL4qyu1ApEFKrHc=@vger.kernel.org X-Gm-Message-State: AOJu0YxbkC2Ob7M+UU3hKHvTGwq4N7469fxTqTExLqRetb0zGUaHp4M6 1AiwSiBndFebBKJx+aFenTqg/IScs2rII7fkdzAMHkUigI+1jLPtSpcu X-Gm-Gg: Acq92OEjU/QHwEZ4lpZLfRfbOtvybQ7/eKJkFZnADVXl+cA486ZcTpSHDF+2qgAvEio 7Ryi4kRmr+dX2USfCojrd3iRzkUO80LynFOx74dZM7BP9YSZ+Rp8EjemzA30pNuyUnjFGGfEHA0 Y+QEFVP0XVJIwBpdbYJEiHnyYlQw7fer0dBW+ESZ0ih4sIdnVVS7taN4JZSoO3ArPdNKUmQyLNa t0bDMmsWK6F1LyvT9plHra76q6oOlgN8g3cWLA2Tvp+4CwDccctjs+tpxqPZkHK8LH4js2xveb2 7fYSH3At17ZtUknYJtGf3L5oyxDvA13ODUf4Oliy2xe4Th/OmIQpNfursTKA+sKRtTTUhCQS8Pm Esc9UwgfKMZr0m39X8oE6vA1FLYXts8diGLfJrpxQewvqxh8UP+E5mkD06de62qwMRYMEHU7od+ bX+t8M9MDgDmvpbG/oqS5Fy/mcy8Gql06nKc3G1UdVXDAkygdIWuAcmVE4liPwxp8GZvlyzwJ36 8gUC9ibatqWooWXYCU6RKD1HXk= X-Received: by 2002:a17:902:ef08:b0:2c1:5135:39f3 with SMTP id d9443c01a7336-2c1e810d9famr55650215ad.11.1780681822667; Fri, 05 Jun 2026 10:50:22 -0700 (PDT) Received: from nugod-NUC15CRHU5.tail9f095a.ts.net ([218.237.104.87]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c16609e636sm97882435ad.51.2026.06.05.10.50.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 05 Jun 2026 10:50:22 -0700 (PDT) From: HyeongJun An To: Alex Hung , Hans de Goede , =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= Cc: Andy Shevchenko , "Rafael J . Wysocki" , platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org, HyeongJun An , stable@vger.kernel.org Subject: [PATCH] platform/x86: intel-hid: Protect ACPI notify handler against recursion Date: Sat, 6 Jun 2026 02:49:05 +0900 Message-ID: <20260605174905.131095-1-sammiee5311@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") ACPI notify handlers like the intel-hid notify_handler() may run on multiple CPU cores racing with themselves. On convertibles and detachables (matched by DMI chassis-type 31 and 32 in dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered lazily from notify_handler() on the first tablet-mode event, via intel_hid_switches_setup(). When two such events race on different CPUs both can pass the !priv->switches check and register the priv->switches input device twice, resulting in a duplicate sysfs entry and a subsequent NULL pointer dereference. This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86: intel-vbtn: Protect ACPI notify handler against recursion") for the sibling intel-vbtn driver. Protect intel-hid notify_handler() from racing with itself with a mutex to fix this. Fixes: e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPU= s") Cc: stable@vger.kernel.org Signed-off-by: HyeongJun An --- drivers/platform/x86/intel/hid.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/= hid.c index 085093506dda..6b4bac5f7051 100644 --- a/drivers/platform/x86/intel/hid.c +++ b/drivers/platform/x86/intel/hid.c @@ -7,11 +7,13 @@ */ =20 #include +#include #include #include #include #include #include +#include #include #include #include @@ -230,6 +232,7 @@ static const struct dmi_system_id dmi_auto_add_switch[]= =3D { }; =20 struct intel_hid_priv { + struct mutex mutex; /* Avoid notify_handler() racing with itself */ struct input_dev *input_dev; struct input_dev *array; struct input_dev *switches; @@ -565,6 +568,8 @@ static void notify_handler(acpi_handle handle, u32 even= t, void *context) struct key_entry *ke; int err; =20 + guard(mutex)(&priv->mutex); + /* * Some convertible have unreliable VGBS return which could cause incorre= ct * SW_TABLET_MODE report, in these cases we enable support when receiving @@ -720,6 +725,10 @@ static int intel_hid_probe(struct platform_device *dev= ice) return -ENOMEM; dev_set_drvdata(&device->dev, priv); =20 + err =3D devm_mutex_init(&device->dev, &priv->mutex); + if (err) + return err; + /* See dual_accel_detect.h for more info on the dual_accel check. */ if (enable_sw_tablet_mode =3D=3D TABLET_SW_AUTO) { if (dmi_check_system(dmi_vgbs_allow_list)) --=20 2.43.0