From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E769A346791 for ; Sun, 12 Jul 2026 16:15:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783872941; cv=none; b=tl859cZLtb4edKE1JaQFaUh5XYCw2mvd5ycpy+5QU+Irau2YkgkjCF4UgSvfZMWgbosggGjnrrbN30NwXs9EXqXg6KodNbSYNa1CLt+CD33HdTWgdjjDjKHea9KTwen81cTl5HO2WMiApXaXNEucWNOqkjoJdlt85b0gF1QWa+g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783872941; c=relaxed/simple; bh=YkAhctjX+TRHvC1ZFnsLlQGb8ZTd9WYXbJyc3v4lB3Y=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ow0d4FfbOPYNnvu+b2VYpiKjw2mFKKKgK4GHSZzRJmIzw0Ch0x07D/BbE7z7HFGT9z0m0iRdU8R4afEfioLoIw43EC1+IGA14OlymPg1yiUM6u3x9F0qyKUydErZBYcjpbHauH+MDvHY4s5YXP/pWpw+6VSZ0OWQYkViMUThhEA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-38dd55ad76cso387828a91.1 for ; Sun, 12 Jul 2026 09:15:38 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783872938; x=1784477738; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=dfAnMuMswVnnhGzvqvLgApeSRSFXVyqWjYS4NcNieRE=; b=GdGORA0nGSN30L+pg2qOKts84BRQZjr8auksgS75Vch5YpvucC8e8C6CZDS72fZTUd lS1HqhBcnSvhbhCtBlE+RFcD4LCkEZJRe/zJpjc1FEIFyMCAH3tmwkllP8Yh2OMckFTl NoXaG7+1ihFbfYAurNzJHhhzcOZxITZfkUd5ysjzcNONDVVbe/TPAGIJ2pD0KUJoHOnQ pUYcN8upZtuAhmxiYVkHLb0/8klMJAn9tb9xI1FDqpg5aNogkFwLBQOl5fEgBLSu2JzN 4K+0u06Oqp/bMEVkZC4oPlMBGAIOAdBDIkW5Omq+UVV9zVR1vlGpNvxi/U9NjSS1iXLu z17g== X-Forwarded-Encrypted: i=1; AHgh+Rqpmo0SHjbo/W97ozYymiX7P4v1Bhb0vQQ98+K0XzWQSmrBv0ta8KcMIg1gXG+1wYqXxdeFosTnS2HWfhc=@vger.kernel.org X-Gm-Message-State: AOJu0YxNvsVdms4wq8fsYalr0hRVhzQg9T6Ek5mSuh6HpqCZlBABZvMm zUklRgyE2dLQJDUKccelrlt/Tk9kLimBvE214mkWriOau8hgmu+bxRA= X-Gm-Gg: AfdE7cnrTKv99NoxEMymnxVpcta0QlOhh7ion9spVxR5cosy7+yKL4i24Pfm74gEf9S PMm5h2qItB99oYtzeM0UEAcWoQ4Q3L/b86AuFeX1ATZfe68ZeA+g9ADI8N5mYJ1ov8OzmPArqNl 7+5PGNBPTzlgO1r6ING2xQrcfaNBzV8Igh5ANyyuDN7T8KK+uMP/Vgjd48/WwFnwVBeiQi0O0ml /DGGQ9AmcOtor1qWyApFzYbELpWrWHLcrpkW2FzGICKoGFdBlXfVGOI8mOZXaSC0YsMSl33oGJJ 94EvKQ4wgqwIBIeoZG1bdYvzpwHJ8gB2sFfPUhOKHeS42pI47mATAObRtiyRM8ptAUQnRkNW2Lp Or/nVeSFIs8J5QzK3i2FQn6bPDwZfxrkBXcg2QnNulgXCzlFtpQLsQ5RCDso+5mku6+LKojRc6J Ucu3ZNVG2a3yYyP85aDgyrMydQ4GeoBJEij7BuS1Jz6DgttdvWITrZ/845WtBRvVdb0mrUuf692 ApwQDivAGsZWu+9Hc+bJ4ZEC9EC X-Received: by 2002:a17:90b:54cb:b0:36b:de66:92c3 with SMTP id 98e67ed59e1d1-38d15361ac4mr11183841a91.10.1783872938070; Sun, 12 Jul 2026 09:15:38 -0700 (PDT) Received: from penguin.tail0a1999.ts.net (61-228-44-142.dynamic-ip.hinet.net. [61.228.44.142]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3118389d9bcsm51034331eec.20.2026.07.12.09.15.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 09:15:37 -0700 (PDT) From: Shih-Yuan Lee To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Shih-Yuan Lee Subject: [PATCH 2/2] Input: applespi - fix use-after-free in applespi_remove() Date: Mon, 13 Jul 2026 00:15:27 +0800 Message-Id: <20260712161527.7350-3-fourdollars@debian.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260712161527.7350-1-fourdollars@debian.org> References: <20260712161527.7350-1-fourdollars@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit applespi_remove() called applespi_drain_writes() to wait for in-flight write transfers, then immediately called acpi_disable_gpe() and acpi_remove_gpe_handler(). However it then called applespi_drain_reads() *after* the GPE handler was removed, which races with any read SPI completion callback that could still reference the applespi struct already being torn down. Moreover, the two drain helpers use separate wait paths that can miss each other: a read completion arriving just after drain_writes() returns but before drain_reads() is called will set read_active, and the subsequent drain_reads() will then wait on a wait_queue that nobody will ever wake because the GPE is already gone. Fix by replacing the two separate drain calls with a single barrier using the existing cancel_spi + wait_event_lock_irq mechanism: - Set cancel_spi = true under the spinlock so that applespi_async() immediately rejects new SPI submissions and wakes the wait queue once all outstanding operations have drained. - Wait for !applespi_async_outstanding() before proceeding with teardown. - Disable the GPE and remove its handler only after all in-flight SPI transfers have completed, eliminating the use-after-free window. Fixes: 0b7a8ac72fc1 ("Input: applespi - add driver for Apple SPI keyboard and touchpad") Signed-off-by: Shih-Yuan Lee --- drivers/input/keyboard/applespi.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/applespi.c index c1065a6ba96c..1f5cc2b4dc30 100644 --- a/drivers/input/keyboard/applespi.c +++ b/drivers/input/keyboard/applespi.c @@ -1900,15 +1900,21 @@ static void applespi_drain_reads(struct applespi_data *applespi) static void applespi_remove(struct spi_device *spi) { struct applespi_data *applespi = spi_get_drvdata(spi); + unsigned long flags; - applespi_drain_writes(applespi); + /* Prevent any new SPI transfers and wait for outstanding ones */ + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); + applespi->cancel_spi = true; + wait_event_lock_irq(applespi->wait_queue, + !applespi_async_outstanding(applespi), + applespi->cmd_msg_lock); + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); + /* Disable GPE and remove handler */ acpi_disable_gpe(NULL, applespi->gpe); acpi_remove_gpe_handler(NULL, applespi->gpe, applespi_notify); device_wakeup_disable(&spi->dev); - applespi_drain_reads(applespi); - debugfs_remove_recursive(applespi->debugfs_root); } -- 2.39.5