Commit ff14dafd authored by Dmitry Torokhov's avatar Dmitry Torokhov
Browse files

Input: uinput - take event lock when submitting FF request "event" 



To avoid racing with FF playback events and corrupting device's event
queue take event_lock spinlock when calling uinput_dev_event() when
submitting a FF upload or erase "event".

Tested-by: default avatarMikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Link: https://patch.msgid.link/adXkf6MWzlB8LA_s@google.com


Cc: stable@vger.kernel.org
Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
parent 4cda78d6

drivers/input/misc/uinput.c

+7 −0
Original line number Diff line number Diff line
@@ -25,8 +25,10 @@ 
#include <linux/module.h>

#include <linux/init.h>

#include <linux/fs.h>

#include <linux/lockdep.h>

#include <linux/miscdevice.h>

#include <linux/overflow.h>

#include <linux/spinlock.h>

#include <linux/input/mt.h>

#include "../input-compat.h"
@@ -76,6 +78,8 @@ static int uinput_dev_event(struct input_dev *dev, 
	struct uinput_device	*udev = input_get_drvdata(dev);

	struct timespec64	ts;



	lockdep_assert_held(&dev->event_lock);



	ktime_get_ts64(&ts);



	udev->buff[udev->head] = (struct input_event) {
@@ -147,6 +151,7 @@ static void uinput_request_release_slot(struct uinput_device *udev, 
static int uinput_request_send(struct uinput_device *udev,

			       struct uinput_request *request)

{

	unsigned long flags;

	int retval = 0;



	spin_lock(&udev->state_lock);
@@ -160,7 +165,9 @@ static int uinput_request_send(struct uinput_device *udev, 
	 * Tell our userspace application about this new request

	 * by queueing an input event.

	 */

	spin_lock_irqsave(&udev->dev->event_lock, flags);

	uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);

	spin_unlock_irqrestore(&udev->dev->event_lock, flags);



 out:

	spin_unlock(&udev->state_lock);