[PATCH v4 0/2] leds: trigger: input-events: Restore previous brightness on input

[PATCH v4 0/2] leds: trigger: input-events: Restore previous brightness on input

[Nikolay Plastinin via B4 Relay]

The input-events trigger turns LEDs back on with LED_FULL, so a keyboard
backlight with several levels always comes back at maximum after being
idle. This series restores the level the user picked instead.

Patch 1 adds led_trigger_for_each_led(), an RCU list iterator in leds.h.
Patch 2 uses it to save and restore each LED's brightness in one loop,
with per-LED state allocated in activate() and freed in deactivate().
There is no new exported function or callback API.

This came up while looking at a keyboard backlight idle timeout for ASUS
laptops in asusctl:
https://github.com/OpenGamingCollective/asusctl/issues/98

Validation for v4: the module builds out of tree with W=1 against Fedora
7.2.12-200.fc44.x86_64 using the patched leds.h. A user-space harness using
the driver functions reproduces a heap-use-after-free with v3 when the
LED remains in the iteration after deactivate(), modelling the
attribute-creation error path. With v4, the same test, brightness restore,
and 10,000 concurrent deactivate/reinitialise cycles pass ASan/UBSan.
The harness substitutes mutexes and a one-element list for kernel
primitives; it is not kernel fault injection or an RCU implementation test.

V4 was tested on an ASUS ROG Flow X13 GV302XV with kernel
7.2.12-200.fc44.x86_64 and no external monitor: brightness levels 1 and 2
were restored after idle timeout and keyboard input, and 20 trigger
activate/deactivate cycles passed. No kernel messages appeared during
the test. The original brightness and trigger were restored afterwards.
No full kernel build has been performed.

LLM assistance was used for the implementation, tests and message drafts.

---
Changes in v4:
- Clear trigger_data under input_events_data.lock before freeing per-LED
  state in deactivate(), as suggested by Lee Jones. This also covers the
  device_add_groups() error path, which deactivates before list removal.
- Update the NULL-state comment to cover activation error unwind.
- Patch 1 is unchanged.
- Link to v3: https://lore.kernel.org/r/20261016-leds-input-events-brightness-v3-0-2c462cafe020@gmail.com

Changes in v3:
- Replace led_trigger_walk_leds() with led_trigger_for_each_led(), an
  RCU list iterator in include/linux/leds.h, as suggested by Lee Jones.
- Remove the exported helper, callback typedef, and void-pointer argument.
- Keep saving and restoring brightness in input_events_set_leds(), using
  guard(rcu)() and a single loop for both the on and off paths.
- Link to v2: https://lore.kernel.org/r/20260930-leds-input-events-brightness-v2-0-3948d3cddd83@gmail.com

Changes in v2:
- Keep the saved brightness in a per-LED struct allocated in activate()
  and freed in deactivate(), stored in led_cdev->trigger_data, instead of
  overloading blink_brightness (Lee Jones).
- Add led_trigger_walk_leds() to led-triggers.c and use it instead of
  walking led_cdevs/trig_list from the trigger (Lee Jones).
- Use the Assisted-by tag format from coding-assistants.rst.
- Link to v1: https://lore.kernel.org/r/20260924-leds-input-events-brightness-v1-1-b0ceff3a2343@gmail.com

---
Nikolay Plastinin (2):
      leds: triggers: Add led_trigger_for_each_led()
      leds: trigger: input-events: Restore previous brightness on input

 drivers/leds/trigger/ledtrig-input-events.c | 76 ++++++++++++++++++++++++++---
 include/linux/leds.h                        | 12 +++++
 2 files changed, 82 insertions(+), 6 deletions(-)
---
base-commit: f475845eaf3d749114a63270bf2efea459e14dd2
change-id: 20260924-leds-input-events-brightness-a76ae9a77b85

Best regards,
-- 
Nikolay Plastinin <plaztininikolai@gmail.com>

[PATCH v4 1/2] leds: triggers: Add led_trigger_for_each_led()

[Nikolay Plastinin via B4 Relay]

From: Nikolay Plastinin <plaztininikolai@gmail.com>

led_trigger_event() sets one brightness for all LEDs using a trigger.
A trigger which restores a different brightness per LED needs to iterate
over the attached LEDs instead.

Add led_trigger_for_each_led(), a wrapper around list_for_each_entry_rcu(),
so triggers can perform this iteration without spelling out the list
members. Document that callers must hold the RCU read lock throughout
the iteration and must not sleep while accessing the LEDs.

Assisted-by: LLM
Signed-off-by: Nikolay Plastinin <plaztininikolai@gmail.com>
---
 include/linux/leds.h | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/include/linux/leds.h b/include/linux/leds.h
index a515f075c..675c58661 100644
--- a/include/linux/leds.h
+++ b/include/linux/leds.h
@@ -11,6 +11,7 @@
 #include <dt-bindings/leds/common.h>
 #include <linux/device.h>
 #include <linux/mutex.h>
+#include <linux/rculist.h>
 #include <linux/rwsem.h>
 #include <linux/spinlock.h>
 #include <linux/timer.h>
@@ -502,6 +503,17 @@ struct led_trigger {
 	const struct attribute_group **groups;
 };
 
+/**
+ * led_trigger_for_each_led - iterate over the LEDs attached to a trigger
+ * @pos: struct led_classdev pointer used as the loop cursor
+ * @trig: trigger whose LEDs are iterated
+ *
+ * The caller must hold the RCU read lock throughout the iteration and must
+ * not sleep while accessing the LEDs.
+ */
+#define led_trigger_for_each_led(pos, trig) \
+	list_for_each_entry_rcu(pos, &(trig)->led_cdevs, trig_list)
+
 /*
  * Currently the attributes in struct led_trigger::groups are added directly to
  * the LED device. As this might change in the future, the following

-- 
2.56.0

[PATCH v4 2/2] leds: trigger: input-events: Restore previous brightness on input

[Nikolay Plastinin via B4 Relay]

From: Nikolay Plastinin <plaztininikolai@gmail.com>

The trigger turns the LEDs back on with LED_FULL, which the LED core
clamps to max_brightness. For keyboard backlights with several levels,
such as asus::kbd_backlight, this means the backlight always comes back
at maximum after being idle instead of at the level the user picked.

Remember the brightness per LED before turning it off and restore it on
the next input event. Keep the level in a per-LED state struct allocated
in activate() and freed in deactivate(), converting the simple trigger
to a regular trigger. Pick up brightness changes made while the LED is
on before saving the level again.

Use led_trigger_for_each_led() under guard(rcu)() for both the on and
off paths. Skip LEDs whose activate() callback has not set up their
state yet.

Clear trigger_data under the same lock used by the LED walker before
freeing the per-LED state. Although normal trigger removal waits for an
RCU grace period, the device_add_groups() error path calls deactivate()
while the LED is still linked, so a walker must see NULL after teardown.

The previous revision was tested on an ASUS ROG Flow X13 GV302XV:
keyboard backlight levels 1 and 2 were restored after idle timeout and
keyboard input, and 20 trigger activate/deactivate cycles completed
successfully.

Assisted-by: LLM
Signed-off-by: Nikolay Plastinin <plaztininikolai@gmail.com>
---
 drivers/leds/trigger/ledtrig-input-events.c | 76 ++++++++++++++++++++++++++---
 1 file changed, 70 insertions(+), 6 deletions(-)

diff --git a/drivers/leds/trigger/ledtrig-input-events.c b/drivers/leds/trigger/ledtrig-input-events.c
index d057b2a23..6b0bfd343 100644
--- a/drivers/leds/trigger/ledtrig-input-events.c
+++ b/drivers/leds/trigger/ledtrig-input-events.c
@@ -28,7 +28,69 @@ static struct input_events_data {
 	unsigned long led_off_time;
 } input_events_data;
 
-static struct led_trigger *input_events_led_trigger;
+struct input_events_led {
+	/* Brightness to restore on the next input event */
+	int brightness;
+};
+
+static int input_events_activate(struct led_classdev *led_cdev)
+{
+	struct input_events_data *data = &input_events_data;
+	struct input_events_led *led;
+	unsigned long flags;
+
+	led = kzalloc_obj(*led);
+	if (!led)
+		return -ENOMEM;
+
+	/* Start with the current brightness, or full if the LED is off */
+	led->brightness = led_cdev->brightness ?: led_cdev->max_brightness;
+
+	spin_lock_irqsave(&data->lock, flags);
+	led_set_trigger_data(led_cdev, led);
+	led_set_brightness(led_cdev, data->led_on ? led->brightness : LED_OFF);
+	spin_unlock_irqrestore(&data->lock, flags);
+
+	return 0;
+}
+
+static void input_events_deactivate(struct led_classdev *led_cdev)
+{
+	struct input_events_led *led;
+
+	scoped_guard(spinlock_irqsave, &input_events_data.lock) {
+		led = led_get_trigger_data(led_cdev);
+		led_set_trigger_data(led_cdev, NULL);
+	}
+	kfree(led);
+}
+
+static struct led_trigger input_events_led_trigger = {
+	.name = "input-events",
+	.activate = input_events_activate,
+	.deactivate = input_events_deactivate,
+};
+
+/* Must be called with input_events_data.lock held */
+static void input_events_set_leds(bool on)
+{
+	struct led_classdev *led_cdev;
+
+	guard(rcu)();
+	led_trigger_for_each_led(led_cdev, &input_events_led_trigger) {
+		struct input_events_led *led = led_get_trigger_data(led_cdev);
+
+		/* Not yet activated, or already deactivated during error unwind */
+		if (!led)
+			continue;
+
+		/* Preserve brightness changes made while the LED was on. */
+		if (led_cdev->brightness)
+			led->brightness = led_cdev->brightness;
+
+		led_set_brightness(led_cdev, on ? led->brightness : LED_OFF);
+	}
+}
 
 static void led_input_events_work(struct work_struct *work)
 {
@@ -42,7 +104,7 @@ static void led_input_events_work(struct work_struct *work)
 	 * running before a new event pushed led_off_time back.
 	 */
 	if (time_after_eq(jiffies, data->led_off_time)) {
-		led_trigger_event(input_events_led_trigger, LED_OFF);
+		input_events_set_leds(false);
 		data->led_on = false;
 	}
 
@@ -59,7 +121,7 @@ static void input_events_event(struct input_handle *handle, unsigned int type,
 	spin_lock_irqsave(&data->lock, flags);
 
 	if (!data->led_on) {
-		led_trigger_event(input_events_led_trigger, LED_FULL);
+		input_events_set_leds(true);
 		data->led_on = true;
 	}
 	data->led_off_time = jiffies + led_off_delay;
@@ -138,11 +200,13 @@ static int __init input_events_init(void)
 	INIT_DELAYED_WORK(&input_events_data.work, led_input_events_work);
 	spin_lock_init(&input_events_data.lock);
 
-	led_trigger_register_simple("input-events", &input_events_led_trigger);
+	ret = led_trigger_register(&input_events_led_trigger);
+	if (ret)
+		return ret;
 
 	ret = input_register_handler(&input_events_handler);
 	if (ret) {
-		led_trigger_unregister_simple(input_events_led_trigger);
+		led_trigger_unregister(&input_events_led_trigger);
 		return ret;
 	}
 
@@ -153,7 +217,7 @@ static void __exit input_events_exit(void)
 {
 	input_unregister_handler(&input_events_handler);
 	cancel_delayed_work_sync(&input_events_data.work);
-	led_trigger_unregister_simple(input_events_led_trigger);
+	led_trigger_unregister(&input_events_led_trigger);
 }
 
 module_init(input_events_init);

-- 
2.56.0