Commit 778322a0 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'input-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 

Pull input fixes from Dmitry Torokhov:
 "Two fixes for force feedback handling in uinput driver:

   - fix circular locking dependency in uinput

   - fix potential corruption of uinput event queue"

* tag 'input-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: uinput - take event lock when submitting FF request "event"
  Input: uinput - fix circular locking dependency with ff-core
parents e774d5f1 ff14dafd

drivers/input/misc/uinput.c

+28 −7
Original line number Diff line number Diff line
@@ -25,8 +25,10 @@ 
#include <linux/module.h>

#include <linux/init.h>

#include <linux/fs.h>

#include <linux/lockdep.h>

#include <linux/miscdevice.h>

#include <linux/overflow.h>

#include <linux/spinlock.h>

#include <linux/input/mt.h>

#include "../input-compat.h"
@@ -57,6 +59,7 @@ struct uinput_device { 
	struct input_dev	*dev;

	struct mutex		mutex;

	enum uinput_state	state;

	spinlock_t		state_lock;

	wait_queue_head_t	waitq;

	unsigned char		ready;

	unsigned char		head;
@@ -75,6 +78,8 @@ static int uinput_dev_event(struct input_dev *dev, 
	struct uinput_device	*udev = input_get_drvdata(dev);

	struct timespec64	ts;



	lockdep_assert_held(&dev->event_lock);



	ktime_get_ts64(&ts);



	udev->buff[udev->head] = (struct input_event) {
@@ -146,27 +151,26 @@ static void uinput_request_release_slot(struct uinput_device *udev, 
static int uinput_request_send(struct uinput_device *udev,

			       struct uinput_request *request)

{

	int retval;

	unsigned long flags;

	int retval = 0;



	retval = mutex_lock_interruptible(&udev->mutex);

	if (retval)

		return retval;

	spin_lock(&udev->state_lock);



	if (udev->state != UIST_CREATED) {

		retval = -ENODEV;

		goto out;

	}



	init_completion(&request->done);



	/*

	 * Tell our userspace application about this new request

	 * by queueing an input event.

	 */

	spin_lock_irqsave(&udev->dev->event_lock, flags);

	uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);

	spin_unlock_irqrestore(&udev->dev->event_lock, flags);



 out:

	mutex_unlock(&udev->mutex);

	spin_unlock(&udev->state_lock);

	return retval;

}
@@ -175,6 +179,13 @@ static int uinput_request_submit(struct uinput_device *udev, 
{

	int retval;



	/*

	 * Initialize completion before allocating the request slot.

	 * Once the slot is allocated, uinput_flush_requests() may

	 * complete it at any time, so it must be initialized first.

	 */

	init_completion(&request->done);



	retval = uinput_request_reserve_slot(udev, request);

	if (retval)

		return retval;
@@ -289,7 +300,14 @@ static void uinput_destroy_device(struct uinput_device *udev) 
	struct input_dev *dev = udev->dev;

	enum uinput_state old_state = udev->state;



	/*

	 * Update state under state_lock so that concurrent

	 * uinput_request_send() sees the state change before we

	 * flush pending requests and tear down the device.

	 */

	spin_lock(&udev->state_lock);

	udev->state = UIST_NEW_DEVICE;

	spin_unlock(&udev->state_lock);



	if (dev) {

		name = dev->name;
@@ -366,7 +384,9 @@ static int uinput_create_device(struct uinput_device *udev) 
	if (error)

		goto fail2;



	spin_lock(&udev->state_lock);

	udev->state = UIST_CREATED;

	spin_unlock(&udev->state_lock);



	return 0;
@@ -384,6 +404,7 @@ static int uinput_open(struct inode *inode, struct file *file) 
		return -ENOMEM;



	mutex_init(&newdev->mutex);

	spin_lock_init(&newdev->state_lock);

	spin_lock_init(&newdev->requests_lock);

	init_waitqueue_head(&newdev->requests_waitq);

	init_waitqueue_head(&newdev->waitq);