mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 03:11:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'input-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Browse Source 
Pull input fixes from Dmitry Torokhov:
 "Two fixes for force feedback handling in uinput driver:

   - fix circular locking dependency in uinput

   - fix potential corruption of uinput event queue"

* tag 'input-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: uinput - take event lock when submitting FF request "event"
  Input: uinput - fix circular locking dependency with ff-core
This commit is contained in:
Linus Torvalds
2026-04-11 11:12:38 -07:00
parent e774d5f1bc ff14dafde1
commit 778322a06e
1 changed files with 28 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
drivers/input/misc/uinput.c
View File

@@ -25,8 +25,10 @@
#include <linux/module.h>
#include <linux/init.h>
#include <linux/fs.h>
#include <linux/lockdep.h>
#include <linux/miscdevice.h>
#include <linux/overflow.h>
#include <linux/spinlock.h>
#include <linux/input/mt.h>
#include "../input-compat.h"
@@ -57,6 +59,7 @@ struct uinput_device {
struct input_dev *dev;
struct mutex mutex;
enum uinput_state state;
spinlock_t state_lock;
wait_queue_head_t waitq;
unsigned char ready;
unsigned char head;
@@ -75,6 +78,8 @@ static int uinput_dev_event(struct input_dev *dev,
struct uinput_device *udev = input_get_drvdata(dev);
struct timespec64 ts;
lockdep_assert_held(&dev->event_lock);
ktime_get_ts64(&ts);
udev->buff[udev->head] = (struct input_event) {
@@ -146,27 +151,26 @@ static void uinput_request_release_slot(struct uinput_device *udev,
static int uinput_request_send(struct uinput_device *udev,
struct uinput_request *request)
{
int retval;
unsigned long flags;
int retval = 0;
retval = mutex_lock_interruptible(&udev->mutex);
if (retval)
return retval;
spin_lock(&udev->state_lock);
if (udev->state != UIST_CREATED) {
retval = -ENODEV;
goto out;
}
init_completion(&request->done);
/*
* Tell our userspace application about this new request
* by queueing an input event.
*/
spin_lock_irqsave(&udev->dev->event_lock, flags);
uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
spin_unlock_irqrestore(&udev->dev->event_lock, flags);
out:
mutex_unlock(&udev->mutex);
spin_unlock(&udev->state_lock);
return retval;
}
@@ -175,6 +179,13 @@ static int uinput_request_submit(struct uinput_device *udev,
{
int retval;
/*
* Initialize completion before allocating the request slot.
* Once the slot is allocated, uinput_flush_requests() may
* complete it at any time, so it must be initialized first.
*/
init_completion(&request->done);
retval = uinput_request_reserve_slot(udev, request);
if (retval)
return retval;
@@ -289,7 +300,14 @@ static void uinput_destroy_device(struct uinput_device *udev)
struct input_dev *dev = udev->dev;
enum uinput_state old_state = udev->state;
/*
* Update state under state_lock so that concurrent
* uinput_request_send() sees the state change before we
* flush pending requests and tear down the device.
*/
spin_lock(&udev->state_lock);
udev->state = UIST_NEW_DEVICE;
spin_unlock(&udev->state_lock);
if (dev) {
name = dev->name;
@@ -366,7 +384,9 @@ static int uinput_create_device(struct uinput_device *udev)
if (error)
goto fail2;
spin_lock(&udev->state_lock);
udev->state = UIST_CREATED;
spin_unlock(&udev->state_lock);
return 0;
@@ -384,6 +404,7 @@ static int uinput_open(struct inode *inode, struct file *file)
return -ENOMEM;
mutex_init(&newdev->mutex);
spin_lock_init(&newdev->state_lock);
spin_lock_init(&newdev->requests_lock);
init_waitqueue_head(&newdev->requests_waitq);
init_waitqueue_head(&newdev->waitq);