summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDmitry Torokhov <dmitry.torokhov@gmail.com>2012-07-29 22:48:31 -0700
committerDmitry Torokhov <dmitry.torokhov@gmail.com>2012-08-21 22:29:52 -0700
commit929d1af5478dec82903e05aa9662a4ec12ad655b (patch)
treea794fc36f04e592a56a8857493968ced44eedfae
parentc0bb1f975ca06b17d595937c5e91578b36047039 (diff)
Input: uinput - take event lock when fetching events from buffer
When fetching events form device's buffer in uinput_read() we need to take input device's event_lock to avoid racing with new event delivery. Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
-rw-r--r--drivers/input/misc/uinput.c27
1 files changed, 24 insertions, 3 deletions
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 736056897e50..1b4ee4a5c49c 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -452,9 +452,28 @@ static ssize_t uinput_write(struct file *file, const char __user *buffer, size_t
return retval;
}
+static bool uinput_fetch_next_event(struct uinput_device *udev,
+ struct input_event *event)
+{
+ bool have_event;
+
+ spin_lock_irq(&udev->dev->event_lock);
+
+ have_event = udev->head != udev->tail;
+ if (have_event) {
+ *event = udev->buff[udev->tail];
+ udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
+ }
+
+ spin_unlock_irq(&udev->dev->event_lock);
+
+ return have_event;
+}
+
static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
{
struct uinput_device *udev = file->private_data;
+ struct input_event event;
int retval = 0;
if (udev->state != UIST_CREATED)
@@ -477,12 +496,14 @@ static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count,
goto out;
}
- while (udev->head != udev->tail && retval + input_event_size() <= count) {
- if (input_event_to_user(buffer + retval, &udev->buff[udev->tail])) {
+ while (retval + input_event_size() <= count &&
+ uinput_fetch_next_event(udev, &event)) {
+
+ if (input_event_to_user(buffer + retval, &event)) {
retval = -EFAULT;
goto out;
}
- udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
+
retval += input_event_size();
}