kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Input: uinput - take event lock when fetching events from buffer

Browse source 
When fetching events form device's buffer in uinput_read() we need to
take input device's event_lock to avoid racing with new event delivery.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
This commit is contained in:
Dmitry Torokhov 2012-07-29 22:48:31 -07:00
parent c0bb1f975c
commit 929d1af547
1 changed files with 24 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
drivers/input/misc/uinput.c
View file

@ -452,9 +452,28 @@ static ssize_t uinput_write(struct file *file, const char __user *buffer, size_t
return retval; return retval;
} }
static bool uinput_fetch_next_event(struct uinput_device *udev,
struct input_event *event)
{
bool have_event;
spin_lock_irq(&udev->dev->event_lock);
have_event = udev->head != udev->tail;
if (have_event) {
*event = udev->buff[udev->tail];
udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
}
spin_unlock_irq(&udev->dev->event_lock);
return have_event;
}
static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos) static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
{ {
struct uinput_device *udev = file->private_data; struct uinput_device *udev = file->private_data;
struct input_event event;
int retval = 0; int retval = 0;
if (udev->state != UIST_CREATED) if (udev->state != UIST_CREATED)
@ -477,12 +496,14 @@ static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count,
goto out; goto out;
} }
while (udev->head != udev->tail && retval + input_event_size() <= count) { while (retval + input_event_size() <= count &&
if (input_event_to_user(buffer + retval, &udev->buff[udev->tail])) { uinput_fetch_next_event(udev, &event)) {
if (input_event_to_user(buffer + retval, &event)) {
retval = -EFAULT; retval = -EFAULT;
goto out; goto out;
} }
udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
retval += input_event_size(); retval += input_event_size();
} }