kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/input/misc
History
Dmitry Torokhov c6e48871d9 Input: uinput - avoid crash when sending FF request to device going away 
commit 6b4877c7bd upstream.

If FF request comes in while uinput device is going away,
uinput_request_send() will fail with -ENODEV, and uinput_request_submit()
will attempt to mark the slot as unused by calling uinput_request_done().
Unfortunately in this case we haven't initialized request->done completion
yet, and we get a crash:

[   39.402036] BUG: spinlock bad magic on CPU#1, fftest/3108
[   39.402046]  lock: 0xffff88006a93bb00, .magic: 00000000, .owner: /39, .owner_cpu: 1217155072
[   39.402055] CPU: 1 PID: 3108 Comm: fftest Tainted: G        W 4.13.0+ #15
[   39.402059] Hardware name: LENOVO 20HQS0EG02/20HQS0EG02, BIOS N1MET37W (1.22 ) 07/04/2017
[   39.402064]  0000000000000086 f0fad82f3ceaa120 ffff88006a93b9a0 ffffffff9de941bb
[   39.402077]  ffff88026df8ae00 ffff88006a93bb00 ffff88006a93b9c0 ffffffff9dca62b7
[   39.402088]  ffff88006a93bb00 ffff88006a93baf8 ffff88006a93b9e0 ffffffff9dca62e7
[   39.402099] Call Trace:
[   39.402112]  [<ffffffff9de941bb>] dump_stack+0x4d/0x63
[   39.402123]  [<ffffffff9dca62b7>] spin_dump+0x97/0x9c
[   39.402130]  [<ffffffff9dca62e7>] spin_bug+0x2b/0x2d
[   39.402138]  [<ffffffff9dca6373>] do_raw_spin_lock+0x28/0xfd
[   39.402147]  [<ffffffff9e3055cd>] _raw_spin_lock_irqsave+0x19/0x1f
[   39.402154]  [<ffffffff9dca05b7>] complete+0x1d/0x48
[   39.402162]  [<ffffffffc04f30af>] 0xffffffffc04f30af
[   39.402167]  [<ffffffffc04f468c>] 0xffffffffc04f468c
[   39.402177]  [<ffffffff9dd59c16>] ? __slab_free+0x22f/0x359
[   39.402184]  [<ffffffff9dcc13e9>] ? tk_clock_read+0xc/0xe
[   39.402189]  [<ffffffffc04f471f>] 0xffffffffc04f471f
[   39.402195]  [<ffffffff9dc9ffe5>] ? __wake_up+0x44/0x4b
[   39.402200]  [<ffffffffc04f3240>] ? 0xffffffffc04f3240
[   39.402207]  [<ffffffff9e0f57f3>] erase_effect+0xa1/0xd2
[   39.402214]  [<ffffffff9e0f58c6>] input_ff_flush+0x43/0x5c
[   39.402219]  [<ffffffffc04f32ad>] 0xffffffffc04f32ad
[   39.402227]  [<ffffffff9e0f174f>] input_flush_device+0x3d/0x51
[   39.402234]  [<ffffffff9e0f69ae>] evdev_flush+0x49/0x5c
[   39.402243]  [<ffffffff9dd62d6e>] filp_close+0x3f/0x65
[   39.402253]  [<ffffffff9dd7dcf7>] put_files_struct+0x66/0xc1
[   39.402261]  [<ffffffff9dd7ddeb>] exit_files+0x47/0x4e
[   39.402270]  [<ffffffff9dc6b329>] do_exit+0x483/0x969
[   39.402278]  [<ffffffff9dc73211>] ? recalc_sigpending_tsk+0x3d/0x44
[   39.402285]  [<ffffffff9dc6c7a2>] do_group_exit+0x42/0xb0
[   39.402293]  [<ffffffff9dc767e1>] get_signal+0x58d/0x5bf
[   39.402300]  [<ffffffff9dc03701>] do_signal+0x37/0x53e
[   39.402307]  [<ffffffff9e0f8401>] ? evdev_ioctl_handler+0xac8/0xb04
[   39.402314]  [<ffffffff9e0f8464>] ? evdev_ioctl+0x10/0x12
[   39.402321]  [<ffffffff9dd74cfa>] ? do_vfs_ioctl+0x42e/0x501
[   39.402328]  [<ffffffff9dc0170e>] prepare_exit_to_usermode+0x66/0x90
[   39.402333]  [<ffffffff9dc0181b>] syscall_return_slowpath+0xe3/0xec
[   39.402339]  [<ffffffff9e305b7b>] int_ret_from_sys_call+0x25/0x8f

While we could solve this by simply initializing the completion earlier, we
are better off rearranging the code a bit so we avoid calling complete() on
requests that we did not send out. This patch consolidates marking request
slots as free in one place (in uinput_request_submit(), the same place
where we acquire them) and having everyone else simply signal completion
of the requests.

Fixes: 00ce756ce5 ("Input: uinput - mark failed submission requests as free")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-01-01 20:51:36 +00:00
..
88pm80x_onkey.c Input: remove use of __devexit 2012-11-24 00:05:38 -08:00
88pm860x_onkey.c Input: 88pm860x_onkey - switch to using managed resources 2014-05-29 00:26:34 -07:00
ab8500-ponkey.c Input: ab8500-ponkey - switch to using managed resources 2014-05-29 00:26:36 -07:00
ad714x-i2c.c Input: ad714x - add CONFIG_PM_SLEEP to suspend/resume functions 2013-03-26 22:09:55 -07:00
ad714x-spi.c Input: ad714x-spi - remove redundant spi_set_drvdata 2013-09-20 09:58:24 -07:00
ad714x.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
ad714x.h Input: ad714x - read the interrupt status registers in a row 2011-08-22 09:59:26 -07:00
adxl34x-i2c.c Input: adxl34x - add CONFIG_PM_SLEEP to suspend/resume functions 2013-03-26 22:09:51 -07:00
adxl34x-spi.c Input: adxl34x - use spi_get_drvdata() 2013-04-07 21:02:29 -07:00
adxl34x.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
adxl34x.h Input: adxl34 - make enable/disable separate from suspend/resume 2010-07-03 13:13:21 -07:00
apanel.c Input: make i2c device ids constant 2010-01-09 23:28:33 -08:00
arizona-haptics.c ASoC: dapm: Add locking to snd_soc_dapm_xxxx_pin functions 2014-02-20 18:40:07 +09:00
ati_remote2.c Input: ati_remote2 - fix crashes on detecting device with invalid descriptor 2016-03-30 14:49:09 +01:00
atlas_btns.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2014-01-24 17:17:30 -08:00
bfin_rotary.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
bma150.c Input: bma150 - extend chip detection for bma180 2014-04-24 23:53:10 -07:00
cm109.c Input: cm109 - validate number of endpoints before using them 2017-07-18 18:40:16 +01:00
cma3000_d0x.c Input: use dev_get_platdata() 2013-12-06 02:06:29 -08:00
cma3000_d0x.h Input: add CMA3000 accelerometer driver 2010-11-30 23:05:21 -08:00
cma3000_d0x_i2c.c Input: remove use of __devexit 2012-11-24 00:05:38 -08:00
cobalt_btns.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
da9052_onkey.c Input: da9052_onkey - use correct register bit for key status 2014-03-26 13:33:09 -07:00
da9055_onkey.c Input: da9055_onkey - remove use of regmap_irq_get_virq() 2014-04-19 13:55:41 -07:00
dm355evm_keys.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
gp2ap002a00f.c Input: use dev_get_platdata() 2013-12-06 02:06:29 -08:00
gpio-beeper.c Input: gpio-beeper - make of_device_id array const 2014-05-14 16:39:55 -07:00
gpio_tilt_polled.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
hp_sdc_rtc.c Input: hp_sdc_rtc - unlock on error in hp_sdc_rtc_read_i8042timer() 2013-11-20 21:15:31 -08:00
ideapad_slidebar.c Input: add driver for slidebar on Lenovo IdeaPad laptops 2013-08-26 09:30:03 -07:00
ims-pcu.c Input: ims-pcu - validate number of endpoints before using them 2017-07-18 18:40:17 +01:00
ixp4xx-beeper.c input: ixp4xx-beeper: don't use symbols from <mach/timex.h> 2013-12-20 11:44:21 +01:00
Kconfig Linux 3.15-rc5 2014-05-14 16:49:19 -07:00
keyspan_remote.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
kxtj9.c Input: use dev_get_platdata() 2013-12-06 02:06:29 -08:00
m68kspkr.c Input: m68kspkr - remove redundant platform_set_drvdata() 2013-05-28 00:57:41 -07:00
Makefile Input: add driver for SOC button array 2014-03-30 23:40:56 -07:00
max8925_onkey.c Input: max8925_onkey - switch to using managed resources 2014-05-29 00:26:35 -07:00
max8997_haptic.c Input: max8997_haptic - add error handling for regulator and pwm 2014-06-07 23:20:24 -07:00
mc13783-pwrbutton.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
mma8450.c Input: mma8450 - add missing i2c_set_clientdata() in mma8450_probe() 2013-11-11 00:01:44 -08:00
mpu3050.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
pcap_keys.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
pcf8574_keypad.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
pcf50633-input.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
pcspkr.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
pm8xxx-vibrator.c Input: pm8xxx-vibrator - add DT match table 2014-03-30 13:25:20 -07:00
pmic8xxx-pwrkey.c Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay 2016-06-15 21:29:24 +01:00
powermate.c Input: powermate - fix oops with malicious USB descriptors 2016-03-29 15:55:16 +01:00
pwm-beeper.c Input: pwm-beeper - fix - scheduling while atomic 2016-08-22 22:38:06 +01:00
rb532_button.c Input: rb532_button - remove redundant dev_set_drvdata 2013-09-18 07:53:41 -07:00
retu-pwrbutton.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
rotary_encoder.c Input: rotary_encoder - make of_device_id array const 2014-05-14 16:39:56 -07:00
sgi_btns.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
sirfsoc-onkey.c Input: sirfsoc-onkey - fix GPL v2 license string typo 2014-07-18 10:19:42 -07:00
soc_button_array.c Input: soc_button_array - remove duplicate inclusion of input.h 2014-05-28 23:35:17 -07:00
sparcspkr.c Input: misc - use platform_{get,set}_drvdata() 2013-05-23 09:34:13 -07:00
twl4030-pwrbutton.c Input: twl4030-pwrbutton - use correct device for irq request 2017-08-26 02:14:42 +01:00
twl4030-vibra.c Input: twl4030-vibra - add missing of_node_put 2014-01-04 00:47:36 -08:00
twl6040-vibra.c Input: twl6040-vibra - use devm functions 2014-05-14 16:39:47 -07:00
uinput.c Input: uinput - avoid crash when sending FF request to device going away 2018-01-01 20:51:36 +00:00
wistron_btns.c Input: wistron_btns - add FS AMILO Pro 8210 support 2014-01-27 22:34:42 -08:00
wm831x-on.c Input: delete non-required instances of include <linux/init.h> 2014-01-06 23:23:57 -08:00
xen-kbdfront.c xen/pvhvm: If xen_platform_pci=0 is set don't blow up (v4). 2014-01-03 14:54:18 -05:00
yealink.c Input: yealink - validate number of endpoints before using them 2017-07-18 18:40:17 +01:00
yealink.h tree-wide: Assorted spelling fixes 2010-02-09 11:13:56 +01:00