[PATCH] platform/x86: dell-rbtn: Serialize access to the rfkill device

[PATCH] platform/x86: dell-rbtn: Serialize access to the rfkill device

[Rosen Penev]

For slider type devices, the rfkill device is created and destroyed
from rbtn_switch_dev() whenever the first notifier is registered or
the last one is unregistered, i.e. when dell-laptop is loaded or
unloaded. rbtn_notify() runs from the ACPI notify workqueue at the
same time and does

	if (rbtn_data->rfkill)
		rbtn_rfkill_query(rbtn_data->rfkill, ...);

with no locking. If the slider is toggled while dell-laptop is being
loaded, rbtn_rfkill_exit() can unregister and free the rfkill device
between the check and its use.

Add a per-device mutex around creating, destroying and querying the
rfkill device. All three run in process context. The rfkill core only
calls back into .query and .set_block, which do not take the new lock.

Fixes: b05ffc95f9ed ("dell-rbtn: Export notifier for other kernel modules")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
Developed with the help of an AI coding assistant (Claude Opus 5.5),
which found the issue and drafted the fix; I reviewed it and am
responsible for it. Builds cleanly with W=1.
Tested on a Dell Precision M4800 running v7.2.15, using the equivalent
backports built as out-of-tree modules: the dell-wifi and dell-bluetooth rfkill devices are
registered and unload/reload with dell-laptop is clean. The race
itself was not reproduced.

 drivers/platform/x86/dell/dell-rbtn.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/platform/x86/dell/dell-rbtn.c b/drivers/platform/x86/dell/dell-rbtn.c
index c0b3877bb27d..a38bd84bac5a 100644
--- a/drivers/platform/x86/dell/dell-rbtn.c
+++ b/drivers/platform/x86/dell/dell-rbtn.c
@@ -5,10 +5,12 @@
 
 */
 
+#include <linux/cleanup.h>
 #include <linux/module.h>
 #include <linux/acpi.h>
 #include <linux/rfkill.h>
 #include <linux/input.h>
+#include <linux/mutex.h>
 #include <linux/platform_device.h>
 
 #include "dell-rbtn.h"
@@ -21,6 +23,7 @@ enum rbtn_type {
 
 struct rbtn_data {
 	enum rbtn_type type;
+	struct mutex rfkill_lock; /* protects rfkill */
 	struct rfkill *rfkill;
 	struct input_dev *input_dev;
 	bool suspended;
@@ -115,6 +118,8 @@ static int rbtn_rfkill_init(struct device *dev)
 	struct rbtn_data *rbtn_data = dev_get_drvdata(dev);
 	int ret;
 
+	guard(mutex)(&rbtn_data->rfkill_lock);
+
 	if (rbtn_data->rfkill)
 		return 0;
 
@@ -142,6 +147,8 @@ static void rbtn_rfkill_exit(struct device *dev)
 {
 	struct rbtn_data *rbtn_data = dev_get_drvdata(dev);
 
+	guard(mutex)(&rbtn_data->rfkill_lock);
+
 	if (!rbtn_data->rfkill)
 		return;
 
@@ -154,6 +161,8 @@ static void rbtn_rfkill_event(struct device *dev)
 {
 	struct rbtn_data *rbtn_data = dev_get_drvdata(dev);
 
+	guard(mutex)(&rbtn_data->rfkill_lock);
+
 	if (rbtn_data->rfkill)
 		rbtn_rfkill_query(rbtn_data->rfkill, ACPI_COMPANION(dev));
 }
@@ -415,6 +424,10 @@ static int rbtn_probe(struct platform_device *pdev)
 	if (!rbtn_data)
 		return -ENOMEM;
 
+	ret = devm_mutex_init(&pdev->dev, &rbtn_data->rfkill_lock);
+	if (ret)
+		return ret;
+
 	ret = rbtn_acquire(device, true);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "Cannot enable device\n");

base-commit: 2800868f63227c8237d70c41e70d441c919620d6
-- 
2.56.0