linux-input.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/6] Input: uinput - return -EINVAL when read buffer size is too small
@ 2012-03-31  6:06 Dmitry Torokhov
  2012-03-31  6:06 ` [PATCH 2/6] Input: uinput - fix race that can block nonblocking read Dmitry Torokhov
                   ` (4 more replies)
  0 siblings, 5 replies; 9+ messages in thread
From: Dmitry Torokhov @ 2012-03-31  6:06 UTC (permalink / raw)
  To: David Herrmann; +Cc: linux-input, aris

From: David Herrmann <dh.herrmann@googlemail.com>

Let's check whether the user-supplied buffer is actually big enough and
return -EINVAL if it is not. This differs from current behavior, which
caused 0 to be returned and actually does not make any sense, as
broken application will simply repeat the read getting into endless
loop.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
---
 drivers/input/misc/uinput.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 7360568..eb9723a 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -457,6 +457,9 @@ static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count,
 	struct uinput_device *udev = file->private_data;
 	int retval = 0;
 
+	if (count < input_event_size())
+		return -EINVAL;
+
 	if (udev->state != UIST_CREATED)
 		return -ENODEV;
 
-- 
1.7.7.6


^ permalink raw reply related	[flat|nested] 9+ messages in thread
* [PATCH 1/6] Input: uinput - take event lock when fetching events from buffer
@ 2012-05-09  8:08 Dmitry Torokhov
  2012-05-09  8:08 ` [PATCH 4/6] Input: uinput - mark failed submission requests as free Dmitry Torokhov
  0 siblings, 1 reply; 9+ messages in thread
From: Dmitry Torokhov @ 2012-05-09  8:08 UTC (permalink / raw)
  To: David Herrmann, Aristeu Rozanski; +Cc: linux-input

When fetching events form device's buffer in uinput_read() we need to
take input device's event_lock to avoid racing with new event delivery.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
---
 drivers/input/misc/uinput.c |   27 ++++++++++++++++++++++++---
 1 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 7360568..1b4ee4a 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -452,9 +452,28 @@ static ssize_t uinput_write(struct file *file, const char __user *buffer, size_t
 	return retval;
 }
 
+static bool uinput_fetch_next_event(struct uinput_device *udev,
+				    struct input_event *event)
+{
+	bool have_event;
+
+	spin_lock_irq(&udev->dev->event_lock);
+
+	have_event = udev->head != udev->tail;
+	if (have_event) {
+		*event = udev->buff[udev->tail];
+		udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
+	}
+
+	spin_unlock_irq(&udev->dev->event_lock);
+
+	return have_event;
+}
+
 static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
 	struct uinput_device *udev = file->private_data;
+	struct input_event event;
 	int retval = 0;
 
 	if (udev->state != UIST_CREATED)
@@ -477,12 +496,14 @@ static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count,
 		goto out;
 	}
 
-	while (udev->head != udev->tail && retval + input_event_size() <= count) {
-		if (input_event_to_user(buffer + retval, &udev->buff[udev->tail])) {
+	while (retval + input_event_size() <= count &&
+	       uinput_fetch_next_event(udev, &event)) {
+
+		if (input_event_to_user(buffer + retval, &event)) {
 			retval = -EFAULT;
 			goto out;
 		}
-		udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
+
 		retval += input_event_size();
 	}
 
-- 
1.7.7.6


^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2012-05-09  8:08 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-03-31  6:06 [PATCH 1/6] Input: uinput - return -EINVAL when read buffer size is too small Dmitry Torokhov
2012-03-31  6:06 ` [PATCH 2/6] Input: uinput - fix race that can block nonblocking read Dmitry Torokhov
2012-04-03 16:28   ` Aristeu Rozanski
2012-04-03 16:41     ` Dmitry Torokhov
2012-03-31  6:06 ` [PATCH 3/6] Input: uinput - return number of bytes copied on partial reads Dmitry Torokhov
2012-03-31  6:06 ` [PATCH 4/6] Input: uinput - mark failed submission requests as free Dmitry Torokhov
2012-03-31  6:06 ` [PATCH 5/6] Input: uinput - specify exact bit sizes on userspace APIs Dmitry Torokhov
2012-03-31  6:06 ` [PATCH 6/6] Input: uinput - fix formatting Dmitry Torokhov
  -- strict thread matches above, loose matches on Subject: below --
2012-05-09  8:08 [PATCH 1/6] Input: uinput - take event lock when fetching events from buffer Dmitry Torokhov
2012-05-09  8:08 ` [PATCH 4/6] Input: uinput - mark failed submission requests as free Dmitry Torokhov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).