Re: [PATCH v7 01/12] Revert "backlight: Remove notifier"

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `backlight_device_get_by_type()` does not take a reference on the returned device pointer, leading to Use-After-Free vulnerabilities in callers.
--

commit 910d8ccf8b36f6154658d6c354c95ebb55830e1d
Author: Mario Limonciello <mario.limonciello@amd.com>

Revert "backlight: Remove notifier"

This reverts commit 5461f3fd74a89757f95f351eb0bc26aafc2a2e91. The
backlight notifier support is needed in order to add backlight control
support into DRM connectors.

> diff --git a/include/linux/backlight.h b/include/linux/backlight.h
> index f29a9ef1052e7..015183d129f96 100644
> --- a/include/linux/backlight.h
> +++ b/include/linux/backlight.h
[ ... ]
> @@ -388,6 +408,8 @@ void devm_backlight_device_unregister(struct device *dev,
>  				      struct backlight_device *bd);
>  void backlight_force_update(struct backlight_device *bd,
>  			    enum backlight_update_reason reason);
> +int backlight_register_notifier(struct notifier_block *nb);
> +int backlight_unregister_notifier(struct notifier_block *nb);
>  struct backlight_device *backlight_device_get_by_name(const char *name);
>  struct backlight_device *backlight_device_get_by_type(enum backlight_type type);

[Severity: High]
This is a pre-existing issue, but does backlight_device_get_by_type() need to
increment the reference count of the returned device pointer?

Currently, backlight_device_get_by_type() in
drivers/video/backlight/backlight.c returns a pointer to the backlight
device without taking a reference:

drivers/video/backlight/backlight.c:backlight_device_get_by_type() {
    ...
    mutex_unlock(&backlight_dev_list_mutex);
    return found ? bd : NULL;
}

Callers like int3406_thermal_probe() in
drivers/thermal/intel/int340x_thermal/int3406_thermal.c call this and
permanently cache the returned pointer:

    bd = backlight_device_get_by_type(BACKLIGHT_RAW);
    if (!bd)
        return -ENODEV;
    d->raw_bd = bd;

Because the reference count is not incremented (for example, via
get_device(&bd->dev)), a concurrent unbind of the raw backlight driver
will unregister and free the backlight device.

The thermal driver remains unaware, and subsequent reads or writes to the
thermal sysfs attributes (such as
/sys/class/thermal/cooling_deviceX/cur_state) will call
int3406_thermal_get_cur_state(), which dereferences the freed pointer
(d->raw_bd->props.brightness).

Could we add get_device() to backlight_device_get_by_type() and update
callers to drop the reference when done?

>  int backlight_device_set_brightness(struct backlight_device *bd,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831210531.2334221-1-mario.limonciello@amd.com?part=1