From nobody Fri Sep 25 00:01:18 2026 Received: from layka.disroot.org (layka.disroot.org [178.21.23.139]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3B79369D5E; Fri, 18 Sep 2026 09:16:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.21.23.139 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789723000; cv=none; b=Ngq05h6n2alIl2ar8qT5Ep1D8M14tQV6zhWPPrZKwxsfr47xZPrEpLiNnOiznNNuLpy7a2MAw1LF2NLkFErjZkeO55//GIq+trgOiyVWB+55UmB++kcQLoeTKRw4+NdW/gqAejRuzYWBrhmgVZxSXSiJOQw4tIdfCjfMuqGmmvs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789723000; c=relaxed/simple; bh=Gj70SKhKTkFloVSYRvnxgg3G8TeN4ve42sODR32xgzQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TfiToeSKuGf4GQ3YHuOZxiIdvyaHiY0rlnrICiDpOqo+ZKZVgDHNh818Yhm+I2ITfkqNyaOw6BT1IHBjPjoVtifmM/iEfoRsRTxRE7jmxPTA4Rl6tNBhVunCSOnK2OOW97O8QGD72PuLA2TXXhDvVsMBFTfAWDl/JsH346UbYNs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=disroot.org; spf=pass smtp.mailfrom=disroot.org; dkim=pass (2048-bit key) header.d=disroot.org header.i=@disroot.org header.b=c0UQFA0a; arc=none smtp.client-ip=178.21.23.139 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=disroot.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=disroot.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=disroot.org header.i=@disroot.org header.b="c0UQFA0a" Received: from mail01.layka.lan (localhost [127.0.0.1]) by disroot.org (Postfix) with ESMTP id 36F0982D07; Fri, 18 Sep 2026 11:16:29 +0200 (CEST) X-Virus-Scanned: SPAM Filter at disroot.org Received: from layka.disroot.org ([127.0.0.1]) by localhost (disroot.org [127.0.0.1]) (amavis, port 10024) with ESMTP id Y0PR11O4Gd0t; Fri, 18 Sep 2026 11:16:28 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=disroot.org; s=mail; t=1789722988; bh=Gj70SKhKTkFloVSYRvnxgg3G8TeN4ve42sODR32xgzQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=c0UQFA0aWAssq02AfuJymxLNGrFNkjN0HEAwguYBqxfqk8QFa+huiuZ5qtgtgyY0Q TFPOgYPI96okqzSFkMJ8BEN4bKRAZMAFLozeSepJ9hJOQau54iTfKmNc6KquAopDuv pxV3XbWZe/ho1h52j//YWnihHI+txO3loqaPnvmXSq5Lle0tzFkvUTQ9mq6L1UEVAz RsiRjZmzeGnrLk1Ij9wQyseheZ/MGSNPElkHK5b+An8Rwgr44p2/FFZyOVMrxs38RF KSV/Hc8aZzDmQAdVwR99VuL56LLihzoikD4mWe6IYa8E98og+TYQQFAoR+KYe6vyrM z1M5msxJviyrg== From: Marco Scardovi To: platform-driver-x86@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Hans de Goede , =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , "Luke D . Jones" , Denis Benato , Corentin Chary , stable@vger.kernel.org Subject: [PATCH 1/2] platform/x86: asus-wmi: Serialize WMI method evaluations with a mutex Date: Fri, 18 Sep 2026 11:14:59 +0200 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Concurrent evaluations of ASUS WMI management methods (from ACPI notify, HID, userspace daemons, and debugfs) enter the BIOS ACPI/SMM interface simultaneously, triggering re-entrant SMIs or EC mailbox buffer corruption. Fix this at the root by introducing a centralized evaluation helper (asus_wmi_evaluate_method_locked()) protected by a global mutex (asus_wmi_eval_lock) using guard(mutex). Route all evaluations of ASUS_WMI_MGMT_GUID (method3, method5, method_buf, and show_call) through this helper. A static mutex is required because asus_wmi_evaluate_method() is an exported symbol used by external modules (such as hid-asus and asus-armoury) that lack access to struct asus_wmi drvdata, and the underlying ASUS ACPI/EC management method is a single physical platform resource. The mutex is non-recursive: nested ACPI/WMI notify handlers must not call back into evaluate on the same task (defer via workqueue, as asus_rfkill_notify already does). The sysfs-versus-notify race predates the later export of asus_wmi_evaluate_method(), so Fixes points at the original shared evaluate helper rather than that export. Link: https://github.com/OpenGamingCollective/asusctl/issues/328 Fixes: d33da3b68669 ("asus-wmi: factorise wmi_evaluate_method call") Cc: stable@vger.kernel.org Signed-off-by: Marco Scardovi Reviewed-by: Denis Benato Reviewed-by: Armin Wolf --- drivers/platform/x86/asus-wmi.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wm= i.c index a65090429ca7..9c69b9b24104 100644 --- a/drivers/platform/x86/asus-wmi.c +++ b/drivers/platform/x86/asus-wmi.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include #include @@ -28,6 +29,7 @@ #include #include #include +#include #include #include #include @@ -353,6 +355,20 @@ static void asus_wmi_show_deprecated(void) =20 /* WMI *******************************************************************= *****/ =20 +/* + * Concurrent evaluations of ASUS WMI methods can re-enter firmware + * SMI/EC mailbox handling and corrupt the mailbox. + */ +static DEFINE_MUTEX(asus_wmi_eval_lock); + +static acpi_status asus_wmi_evaluate_method_locked(u32 method_id, + struct acpi_buffer *input, + struct acpi_buffer *output) +{ + guard(mutex)(&asus_wmi_eval_lock); + return wmi_evaluate_method(ASUS_WMI_MGMT_GUID, 0, method_id, input, outpu= t); +} + static int asus_wmi_evaluate_method3(u32 method_id, u32 arg0, u32 arg1, u32 arg2, u32 *retval) { @@ -367,8 +383,7 @@ static int asus_wmi_evaluate_method3(u32 method_id, union acpi_object *obj; u32 tmp =3D 0; =20 - status =3D wmi_evaluate_method(ASUS_WMI_MGMT_GUID, 0, method_id, - &input, &output); + status =3D asus_wmi_evaluate_method_locked(method_id, &input, &output); =20 pr_debug("%s called (0x%08x) with args: 0x%08x, 0x%08x, 0x%08x\n", __func__, method_id, arg0, arg1, arg2); @@ -419,8 +434,7 @@ static int asus_wmi_evaluate_method5(u32 method_id, union acpi_object *obj; u32 tmp =3D 0; =20 - status =3D wmi_evaluate_method(ASUS_WMI_MGMT_GUID, 0, method_id, - &input, &output); + status =3D asus_wmi_evaluate_method_locked(method_id, &input, &output); =20 pr_debug("%s called (0x%08x) with args: 0x%08x, 0x%08x, 0x%08x, 0x%08x, 0= x%08x\n", __func__, method_id, arg0, arg1, arg2, arg3, arg4); @@ -467,8 +481,7 @@ static int asus_wmi_evaluate_method_buf(u32 method_id, union acpi_object *obj; int err =3D 0; =20 - status =3D wmi_evaluate_method(ASUS_WMI_MGMT_GUID, 0, method_id, - &input, &output); + status =3D asus_wmi_evaluate_method_locked(method_id, &input, &output); =20 pr_debug("%s called (0x%08x) with args: 0x%08x, 0x%08x\n", __func__, method_id, arg0, arg1); @@ -5026,9 +5039,8 @@ static int show_call(struct seq_file *m, void *data) union acpi_object *obj; acpi_status status; =20 - status =3D wmi_evaluate_method(ASUS_WMI_MGMT_GUID, - 0, asus->debug.method_id, - &input, &output); + status =3D asus_wmi_evaluate_method_locked(asus->debug.method_id, + &input, &output); =20 if (ACPI_FAILURE(status)) return -EIO; --=20 2.55.0 From nobody Fri Sep 25 00:01:18 2026 Received: from layka.disroot.org (layka.disroot.org [178.21.23.139]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3AED364927; Fri, 18 Sep 2026 09:16:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.21.23.139 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789722999; cv=none; b=g1BxRPsIUDLKDzV1jsKoCvhbM40AUAn5+eauOvbXflYIlxuJqafnzI96TtEzcNa+woQ7N07KvbU+VIvRrr+ElMz5Esofg3Mka3LgNuFktyy9tYEArK3KUvCqgaVeH1BqYAdWzXJ37u3M6PHAGtS0Ve17I0klpL62FoUd1QI9r70= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789722999; c=relaxed/simple; bh=7HP5JsYQd16uu9uvZXEXmpVum1FlQW2TA2dhY7SSqXw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WNOojPVdUyh0OMXM3iBbK3haNq13pCyVWOcO4w3QOpOKi8aCJg7dqmb4Jq7TYwP3goIF6GSJLBJjTV0zaJ8LBZ10g6cvkRzhnAHhSgNH+3cJwZj/N8gabLYRZXdGEK3yJ1gbBU5J95bsl9z/PHMgyclGpA70YCvp8OBbnTLxOAU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=disroot.org; spf=pass smtp.mailfrom=disroot.org; dkim=pass (2048-bit key) header.d=disroot.org header.i=@disroot.org header.b=jwPsbS9V; arc=none smtp.client-ip=178.21.23.139 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=disroot.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=disroot.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=disroot.org header.i=@disroot.org header.b="jwPsbS9V" Received: from mail01.layka.lan (localhost [127.0.0.1]) by disroot.org (Postfix) with ESMTP id 77CB78104E; Fri, 18 Sep 2026 11:16:29 +0200 (CEST) X-Virus-Scanned: SPAM Filter at disroot.org Received: from layka.disroot.org ([127.0.0.1]) by localhost (disroot.org [127.0.0.1]) (amavis, port 10024) with ESMTP id Je7zDcAKGo7s; Fri, 18 Sep 2026 11:16:28 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=disroot.org; s=mail; t=1789722988; bh=7HP5JsYQd16uu9uvZXEXmpVum1FlQW2TA2dhY7SSqXw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jwPsbS9V5bBGHGMt9fw9tH7vDhA5qZvqOWQyebY0cn8q+YrqxFNnNNxDPAfvBF5gA /PjFoTkmg5k3Y8KvY0hQKpgp0PMojcgFT0d0D1mWuGBtwcPB9NRmr6qorKKsdZ2qax ie1nTVvm445A7pn2tQ0JWBocYSN8WrcLz3iFdkNNHtpvQXhVHVu6wDRLl2AvSz6yyn fhopmIdPBXnI+M+S1UuqLdZPIEiM/G2zIpmA7DQ2j63OJnT9pDmokBKkwsfjiubFMh WG/6/HJgK1AZW9R5i9Q/5c/fUTmZYZAnWLEGInfdm7zVST7qGLtSrGUB98TiAkky1c 5Qd3CgSEWDyQQ== From: Marco Scardovi To: platform-driver-x86@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Hans de Goede , =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , "Luke D . Jones" , Denis Benato , Corentin Chary , stable@vger.kernel.org Subject: [PATCH 2/2] platform/x86: asus-wmi: Remove redundant per-device wmi_lock and duplicate rfkill ops Date: Fri, 18 Sep 2026 11:15:00 +0200 Message-ID: <035f8cc544ebedc31f29bf1918ee54c623147717.1789722252.git.scardracs@disroot.org> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" With all WMI method evaluations serialized globally by asus_wmi_eval_lock in asus_wmi_evaluate_method_locked(), the per-device wmi_lock in struct asus_wmi is completely redundant. Remove wmi_lock from struct asus_wmi, its initialization in asus_wmi_rfkill_init(), and its manual locking in asus_rfkill_hotplug(). Consequently, asus_rfkill_wlan_set() becomes a simple pass-through to asus_rfkill_set(), rendering asus_rfkill_wlan_ops identical to asus_rfkill_ops. Drop asus_rfkill_wlan_set() and asus_rfkill_wlan_ops, allocating WLAN rfkill devices with &asus_rfkill_ops directly. Signed-off-by: Marco Scardovi Reviewed-by: Denis Benato Reviewed-by: Armin Wolf --- drivers/platform/x86/asus-wmi.c | 37 ++------------------------------- 1 file changed, 2 insertions(+), 35 deletions(-) diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wm= i.c index 9c69b9b24104..9ceaea504e94 100644 --- a/drivers/platform/x86/asus-wmi.c +++ b/drivers/platform/x86/asus-wmi.c @@ -332,7 +332,6 @@ struct asus_wmi { =20 struct hotplug_slot hotplug_slot; struct mutex hotplug_lock; - struct mutex wmi_lock; struct workqueue_struct *hotplug_workqueue; struct work_struct hotplug_work; =20 @@ -2245,9 +2244,7 @@ static void asus_rfkill_hotplug(struct asus_wmi *asus) bool absent; u32 l; =20 - mutex_lock(&asus->wmi_lock); blocked =3D asus_wlan_rfkill_blocked(asus); - mutex_unlock(&asus->wmi_lock); =20 mutex_lock(&asus->hotplug_lock); pci_lock_rescan_remove(); @@ -2449,30 +2446,6 @@ static void asus_rfkill_query(struct rfkill *rfkill,= void *data) rfkill_set_sw_state(priv->rfkill, !result); } =20 -static int asus_rfkill_wlan_set(void *data, bool blocked) -{ - struct asus_rfkill *priv =3D data; - struct asus_wmi *asus =3D priv->asus; - int ret; - - /* - * This handler is enabled only if hotplug is enabled. - * In this case, the asus_wmi_set_devstate() will - * trigger a wmi notification and we need to wait - * this call to finish before being able to call - * any wmi method - */ - mutex_lock(&asus->wmi_lock); - ret =3D asus_rfkill_set(data, blocked); - mutex_unlock(&asus->wmi_lock); - return ret; -} - -static const struct rfkill_ops asus_rfkill_wlan_ops =3D { - .set_block =3D asus_rfkill_wlan_set, - .query =3D asus_rfkill_query, -}; - static const struct rfkill_ops asus_rfkill_ops =3D { .set_block =3D asus_rfkill_set, .query =3D asus_rfkill_query, @@ -2491,13 +2464,8 @@ static int asus_new_rfkill(struct asus_wmi *asus, arfkill->dev_id =3D dev_id; arfkill->asus =3D asus; =20 - if (dev_id =3D=3D ASUS_WMI_DEVID_WLAN && - asus->driver->quirks->hotplug_wireless) - *rfkill =3D rfkill_alloc(name, &asus->platform_device->dev, type, - &asus_rfkill_wlan_ops, arfkill); - else - *rfkill =3D rfkill_alloc(name, &asus->platform_device->dev, type, - &asus_rfkill_ops, arfkill); + *rfkill =3D rfkill_alloc(name, &asus->platform_device->dev, type, + &asus_rfkill_ops, arfkill); =20 if (!*rfkill) return -EINVAL; @@ -2571,7 +2539,6 @@ static int asus_wmi_rfkill_init(struct asus_wmi *asus) int result =3D 0; =20 mutex_init(&asus->hotplug_lock); - mutex_init(&asus->wmi_lock); =20 result =3D asus_new_rfkill(asus, &asus->wlan, "asus-wlan", RFKILL_TYPE_WLAN, ASUS_WMI_DEVID_WLAN); --=20 2.55.0