summaryrefslogtreecommitdiff
path: root/drivers/hid
diff options
context:
space:
mode:
authorJiri Kosina <jkosina@suse.cz>2013-04-16 15:40:09 -0700
committerJiri Kosina <jkosina@suse.cz>2013-04-30 10:09:31 +0200
commit2353f2bea307390e015493118e425152b8a5a431 (patch)
treebeb7fd2471690bbd8b0d0982c3b1f40f6784adba /drivers/hid
parenta5f04b9df1113e0c16271afe5e43028f0d763f13 (diff)
HID: protect hid_debug_list
Accesses to hid_device->hid_debug_list are not serialized properly, which could result in SMP concurrency issues when HID debugfs events are accessesed by multiple userspace processess. Serialize all the list operations by a mutex. Spotted by Al Viro. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
-rw-r--r--drivers/hid/hid-core.c1
-rw-r--r--drivers/hid/hid-debug.c6
2 files changed, 7 insertions, 0 deletions
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f86dd9708ca5..e7765ede339e 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2319,6 +2319,7 @@ struct hid_device *hid_allocate_device(void)
init_waitqueue_head(&hdev->debug_wait);
INIT_LIST_HEAD(&hdev->debug_list);
+ mutex_init(&hdev->debug_list_lock);
sema_init(&hdev->driver_lock, 1);
return hdev;
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 094cbcfe1e1a..7e56cb3855e3 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -580,12 +580,14 @@ void hid_debug_event(struct hid_device *hdev, char *buf)
int i;
struct hid_debug_list *list;
+ mutex_lock(&hdev->debug_list_lock);
list_for_each_entry(list, &hdev->debug_list, node) {
for (i = 0; i < strlen(buf); i++)
list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] =
buf[i];
list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE;
}
+ mutex_unlock(&hdev->debug_list_lock);
wake_up_interruptible(&hdev->debug_wait);
}
@@ -990,7 +992,9 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
file->private_data = list;
mutex_init(&list->read_mutex);
+ mutex_lock(&list->hdev->debug_list_lock);
list_add_tail(&list->node, &list->hdev->debug_list);
+ mutex_unlock(&list->hdev->debug_list_lock);
out:
return err;
@@ -1085,7 +1089,9 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
{
struct hid_debug_list *list = file->private_data;
+ mutex_lock(&list->hdev->debug_list_lock);
list_del(&list->node);
+ mutex_unlock(&list->hdev->debug_list_lock);
kfree(list->hid_debug_buf);
kfree(list);