[PATCH 1/3] input: evdev: only allow reading events if a full packet is present

[PATCH 1/3] input: evdev: only allow reading events if a full packet is present

[Dima Zavin]

Without this, it was possible for the reader to get ahead of packet_head.
If the the input device generated a partial packet *right* after the
reader got ahead, then we can get into a situation where the device is
marked readable but read always returns 0 until the next packet is
finished (i.e a SYN is generated by the input driver).

This situation can also happen if we overflow the buffer while a reader
is trying to read an event out.

Cc: Jeff Brown <jeffbrown@android.com>
Signed-off-by: Dima Zavin <dima@android.com>
---
 drivers/input/evdev.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 4cf2534..03344b3 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -369,7 +369,7 @@ static int evdev_fetch_next_event(struct evdev_client *client,
 
 	spin_lock_irq(&client->buffer_lock);
 
-	have_event = client->head != client->tail;
+	have_event = client->packet_head != client->tail;
 	if (have_event) {
 		*event = client->buffer[client->tail++];
 		client->tail &= client->bufsize - 1;
-- 
1.7.3.1

[PATCH 2/3] input: evdev: if no events and non-block, return EAGAIN not 0

[Dima Zavin]

Cc: Jeff Brown <jeffbrown@android.com>
Signed-off-by: Dima Zavin <dima@android.com>
---
 drivers/input/evdev.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 03344b3..2e563af 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -412,6 +412,8 @@ static ssize_t evdev_read(struct file *file, char __user *buffer,
 		retval += input_event_size();
 	}
 
+	if (retval == 0 && file->f_flags & O_NONBLOCK)
+		retval = -EAGAIN;
 	return retval;
 }
 
-- 
1.7.3.1

[PATCH 3/3] input: evdev: do not block waiting for an event if fd is nonblock

[Dima Zavin]

If there is a full packet in the buffer, and we overflow that buffer
right after checking for that condition, it would have been possible
for us to block indefinitely (rather, until the next full packet) even if
the file was marked as O_NONBLOCK.

Cc: Jeff Brown <jeffbrown@android.com>
Signed-off-by: Dima Zavin <dima@android.com>
---
 drivers/input/evdev.c |   14 ++++++--------
 1 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 2e563af..2fb77e1 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -391,14 +391,12 @@ static ssize_t evdev_read(struct file *file, char __user *buffer,
 	if (count < input_event_size())
 		return -EINVAL;
 
-	if (client->packet_head == client->tail && evdev->exist &&
-	    (file->f_flags & O_NONBLOCK))
-		return -EAGAIN;
-
-	retval = wait_event_interruptible(evdev->wait,
-		client->packet_head != client->tail || !evdev->exist);
-	if (retval)
-		return retval;
+	if (!(file->f_flags & O_NONBLOCK)) {
+		retval = wait_event_interruptible(evdev->wait,
+			 client->packet_head != client->tail || !evdev->exist);
+		if (retval)
+			return retval;
+	}
 
 	if (!evdev->exist)
 		return -ENODEV;
-- 
1.7.3.1