Commit 5e946ed3 authored by Milo Kim's avatar Milo Kim Committed by Greg Kroah-Hartman

leds: turn off the LED and wait for completion on unregistering LED class device

commit d1aa577f upstream.

Workqueue, 'set_brightness_work' is used for scheduling brightness control.
This workqueue is canceled when the LED class device is unregistered.
Currently, LED subsystem handles like below.

  led_set_brightness(led_cdev, LED_OFF)

However, this could be a problem.
Workqueue is going to be canceled but LED device needs to be off.
The worst case is null pointer access due to scheduling a workqueue.

LED module is loaded.
  LED driver private data is allocated by using devm_zalloc().

LED module is unloaded.
  led_classdev_unregister() is called.
      led_set_brightness(led_cdev, LED_OFF)
        schedule_work() if LED driver uses brightness_set_blocking()
        In the meantime, driver private data will be freed.


        brightness_set_blocking() callback is invoked.
          For the brightness control, LED driver tries to access private
          data but resource is removed!

To avoid this problem, LED subsystem should turn off the brightness first
and wait for completion.

  led_set_brightness(led_cdev, LED_OFF)

It guarantees that LED driver turns off the brightness prior to
resource management.

Signed-off-by: default avatarMilo Kim <>
Signed-off-by: default avatarJacek Anaszewski <>
Signed-off-by: default avatarKrzysztof Kozlowski <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent c5cc3e03
......@@ -247,12 +247,13 @@ void led_classdev_unregister(struct led_classdev *led_cdev)
/* Stop blinking */
led_set_brightness(led_cdev, LED_OFF);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment