From: George Stark gnstark@salutedevices.com

mainline inclusion from mainline-v6.10-rc1 commit c382e2e3eccb6b7ca8c7aff5092c1668428e7de6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGRQX CVE: CVE-2024-42128

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

--------------------------------

In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregistered after module's remove() is done. led_classdev_unregister() calls module's led_set_brightness() to turn off the LEDs and that callback uses mutex which was destroyed already in module's remove() so use devm API instead.

Signed-off-by: George Stark gnstark@salutedevices.com Reviewed-by: Andy Shevchenko andy.shevchenko@gmail.com Link: https://lore.kernel.org/r/20240411161032.609544-9-gnstark@salutedevices.com Signed-off-by: Lee Jones lee@kernel.org Conflicts: drivers/leds/leds-an30259a.c [Context conflicts.] Signed-off-by: GONG, Ruiqi gongruiqi1@huawei.com --- drivers/leds/leds-an30259a.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/drivers/leds/leds-an30259a.c b/drivers/leds/leds-an30259a.c index a0df1fb28774..374011e3121e 100644 --- a/drivers/leds/leds-an30259a.c +++ b/drivers/leds/leds-an30259a.c @@ -296,7 +296,10 @@ static int an30259a_probe(struct i2c_client *client) if (err < 0) return err;

- mutex_init(&chip->mutex); + err = devm_mutex_init(&client->dev, &chip->mutex); + if (err) + return err; + chip->client = client; i2c_set_clientdata(client, chip);

@@ -330,19 +333,9 @@ static int an30259a_probe(struct i2c_client *client) return 0;

exit: - mutex_destroy(&chip->mutex); return err; }

-static int an30259a_remove(struct i2c_client *client) -{ - struct an30259a *chip = i2c_get_clientdata(client); - - mutex_destroy(&chip->mutex); - - return 0; -} - static const struct of_device_id an30259a_match_table[] = { { .compatible = "panasonic,an30259a", }, { /* sentinel */ }, @@ -362,7 +355,6 @@ static struct i2c_driver an30259a_driver = { .of_match_table = of_match_ptr(an30259a_match_table), }, .probe_new = an30259a_probe, - .remove = an30259a_remove, .id_table = an30259a_id, };